mariadb-corporation

Products

Exploited and recent CVEs

• CVE-2026-119281 Medium 5.9 MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing 0.3%
• CVE-2026-119280 Low 3.7 MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths 0.3%
• CVE-2026-119279 Medium 5.9 MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths 0.4%
• CVE-2026-119278 Medium 5.9 MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication 0.4%
• CVE-2026-119277 Medium 5.9 MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths 0.4%
• CVE-2026-119276 Medium 5.9 MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets 0.4%
• CVE-2026-119210 Medium 5.9 MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files 0.3%
• CVE-2026-107385 High 7.4 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES 0.4%
• CVE-2026-107384 High 8.1 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) 0.4%
• CVE-2026-107383 High 7.5 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters 0.4%
• CVE-2026-107382 Medium 5.9 MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS 0.2%
• CVE-2026-61700 Low 3.7 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests 0.4%
• CVE-2026-55860 Medium 5.9 MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport) 0.2%
• CVE-2026-55859 Medium 5.9 MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb 0.5%
• CVE-2026-55858 Medium 5.9 MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client 0.9%
• CVE-2026-55857 Medium 5.9 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials 0.4%
• CVE-2026-55856 Medium 5.9 MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake 0.4%
• CVE-2026-55855 Medium 6.5 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets 0.7%
• CVE-2026-55854 Medium 5.9 MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb 0.4%
• CVE-2026-55215 High 7.5 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true` 0.6%