https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:12:39.888109+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:33093 ALSA-2026:33093 — Important: mariadb10.11 security, bug fix, and enhancement update 2026-10-03T03:12:40.435610+00:00

Affected: AlmaLinux:10: mariadb, AlmaLinux:10: mariadb-backup, AlmaLinux:10: mariadb-client-utils, AlmaLinux:10: mariadb-common, AlmaLinux:10: mariadb-devel, AlmaLinux:10: mariadb-embedded, AlmaLinux:10: mariadb-embedded-devel, AlmaLinux:10: mariadb-errmsg, AlmaLinux:10: mariadb-gssapi-server, AlmaLinux:10: mariadb-oqgraph-engine and 5 more

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-14967 bdu:2026-14967 2026-10-03T03:12:40.435699+00:00 bdu:2026-14967 https://cve.radiocsirt.org/vuln/bell-cve-2026-49261 BELL-CVE-2026-49261 2026-10-03T03:12:40.435724+00:00

Affected: Alpaquita:23: mariadb, Alpaquita:25: mariadb, Alpaquita:stream: mariadb

 https://cve.radiocsirt.org/vuln/bit-mariadb-2026-49261 BIT-mariadb-2026-49261 — MariaDB server has unsafe parameter handling in `wsrep_notify_cmd` 2026-10-03T03:12:40.435748+00:00

Affected: Bitnami: mariadb

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

 https://cve.radiocsirt.org/vuln/euvd-2026-351375 EUVD-2026-351375 2026-10-03T03:12:40.435771+00:00 EUVD-2026-351375 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49261 fkie_cve-2026-49261 2026-10-03T03:12:40.435783+00:00

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

 https://cve.radiocsirt.org/vuln/oesa-2026-2732 OESA-2026-2732 — mariadb security update 2026-10-03T03:12:40.435805+00:00

Affected: openEuler:24.03-LTS-SP3: mariadb

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es):

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.(CVE-2026-49261)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10934-1 openSUSE-SU-2026:10934-1 — libmariadbd-devel-11.8.8-1.1 on GA media 2026-10-03T03:12:40.435830+00:00

libmariadbd-devel-11.8.8-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:25143 RHSA-2026:25143 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T03:12:40.435848+00:00

mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine mariadb: mbstream: Unauthorized file creation via path traversal mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries urllib3: urllib3: Denial of Service due to excessive HTTP response decompression mariadb: Arbitrary code execution via improper parameter validation during SST mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

 https://cve.radiocsirt.org/vuln/rlsa-2026:33093 RLSA-2026:33093 — Important: mariadb10.11 security, bug fix, and enhancement update 2026-10-03T03:12:40.435877+00:00

Affected: Rocky Linux:10: mariadb10.11

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22095-1 SUSE-SU-2026:22095-1 — Security update for mariadb 2026-10-03T03:12:40.435902+00:00

Security update for mariadb

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49261 UBUNTU-CVE-2026-49261 2026-10-03T03:12:40.435924+00:00

Affected: Ubuntu:16.04:LTS: mariadb-10.0, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3, Ubuntu:22.04:LTS: mariadb-10.6, Ubuntu:24.04:LTS: mariadb, Ubuntu:25.10: mariadb, Ubuntu:26.04:LTS: mariadb

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1744 WID-SEC-W-2026-1744 — MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff 2026-10-03T03:12:40.435952+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.