Vulnerabilidades em mariadb-corporation
20 resultadosAnálise Vexday
MariaDB Corporation registra 8 vulnerabilidades na base, todas publicadas nos últimos 90 dias, indicando atividade recente de descoberta e divulgação. Nenhuma está sob ataque ativo conhecido (KEV) e não há críticas de severidade máxima, mas a fraqueza dominante (CWE-522: credenciais armazenadas inadequadamente) aponta risco de comprometimento de autenticação. O padrão sugere questões de segurança em gestão de credenciais que merecem atenção prioritária em ambientes que usam esse software.
CVE-2026-55858MEDIUMMariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientEPSS 0.9%CVE-2026-55855MEDIUMMariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsEPSS 0.7%CVE-2026-55215HIGHMariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`EPSS 0.6%CVE-2026-55859MEDIUMMariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbEPSS 0.5%CVE-2026-107384HIGHMariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)EPSS 0.4%CVE-2026-55856MEDIUMMariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeEPSS 0.4%CVE-2026-107385HIGHMariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESEPSS 0.4%CVE-2026-55854MEDIUMMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbEPSS 0.4%CVE-2026-55857MEDIUMMariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsEPSS 0.4%CVE-2026-107383HIGHMariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersEPSS 0.4%CVE-2026-61700LOWMariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsEPSS 0.4%CVE-2026-119278MEDIUMMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationEPSS 0.4%CVE-2026-119277MEDIUMMariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengthsEPSS 0.4%CVE-2026-119279MEDIUMMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsEPSS 0.4%CVE-2026-119276MEDIUMMariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsEPSS 0.4%CVE-2026-119280LOWMariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsEPSS 0.3%CVE-2026-119210MEDIUMMariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client filesEPSS 0.3%CVE-2026-119281MEDIUMMariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingEPSS 0.3%CVE-2026-107382MEDIUMMariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSEPSS 0.2%CVE-2026-55860MEDIUMMariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)EPSS 0.2%