CVE-2026-102523, CVE-2026-107814, CVE-2026-107815 +19 more CVEs: mariadb 13.0.1; +5 more affected products

CVE-2026-102523

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

CVE-2026-107814

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · User interaction required

What an attacker can do

A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Vendor/CNA’s CVSS 3.1 assessment (base score 8.4/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-107815

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 8.5/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-107816

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality and availability impact as low; integrity impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-107817

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

The source reports that an attacker could access information they should not be able to access. Vendor/CNA’s CVSS 3.1 assessment (base score 4.4/10) rates confidentiality and availability impact as low; integrity impact as none.

CVE-2026-107818

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · User interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 8.4/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-107821

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 8.0/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-107822

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · User interaction required

What an attacker can do

An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. Vendor/CNA’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-107823

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · from 13.0.1 (inclusive), before 13.0.2 (exclusive)
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-47023

Affected technology

mysql server · from 8.4.0 (inclusive), through 8.4.10 (inclusive)
oracle

mysql server · 9.7.0
oracle

mysql server · 9.7.1
oracle

mysql cluster · from 8.0.0 (inclusive), through 8.0.47 (inclusive)
oracle

mysql cluster · from 8.4.0 (inclusive), through 8.4.10 (inclusive)
oracle

mysql cluster · 9.7.0
oracle

mysql cluster · 9.7.1
oracle

MySQL Server · 8.4.0-8.4.10, 9.7.0-9.7.1
Oracle Corporation

MySQL Cluster · 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1
Oracle Corporation

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

High privileged attacker with network access via multiple protocols can compromise MySQL Server, MySQL Cluster. Vendor/CNA’s CVSS 3.1 assessment (base score 4.9/10) rates confidentiality and integrity impact as none; availability impact as high.

CVE-2026-60184

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-60331

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · High privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-60585

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-60747

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-61081

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-85745

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none.

CVE-2026-85746

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-85748

Affected technology

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-85985

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.

CVE-2026-86047

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. Vendor/CNA’s CVSS 3.1 assessment (base score 7.7/10) rates confidentiality impact as none; integrity and availability impact as high.

CVE-2026-92262

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality, integrity and availability impact as high.

CVE-2026-97380

Affected technology

mariadb · from 10.6.1 (inclusive), before 10.6.28 (exclusive)
mariadb

mariadb · from 10.11.1 (inclusive), before 10.11.19 (exclusive)
mariadb

mariadb · from 11.4.1 (inclusive), before 11.4.13 (exclusive)
mariadb

mariadb · from 11.8.1 (inclusive), before 11.8.9 (exclusive)
mariadb

mariadb · from 12.3.1 (inclusive), before 12.3.3 (exclusive)
mariadb

mariadb · 13.0.1
mariadb

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.