https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:47:18 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-44168 <p><strong>Affected:</strong> Alpaquita:23: mariadb, Alpaquita:25: mariadb, Alpaquita:stream: mariadb</p> <p><strong>Affected:</strong> Alpaquita:23: mariadb, Alpaquita:25: mariadb, Alpaquita:stream: mariadb</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-44168 https://cve.radiocsirt.org/vuln/bit-mariadb-2026-44168 <p><strong>Affected:</strong> Bitnami: mariadb</p> <p>MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.</p> <p><strong>Affected:</strong> Bitnami: mariadb</p> <p>MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.</p> https://cve.radiocsirt.org/vuln/bit-mariadb-2026-44168 https://cve.radiocsirt.org/vuln/euvd-2026-343636 EUVD-2026-343636 https://cve.radiocsirt.org/vuln/euvd-2026-343636 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44168 <p>MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.</p> <p>MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44168 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10897-1 <p>libmariadbd-devel-11.8.7-1.1 on GA media</p> <p>libmariadbd-devel-11.8.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10897-1 https://cve.radiocsirt.org/vuln/rhsa-2026:25143 <p>mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine mariadb: mbstream: Unauthorized file creation via path traversal mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries urllib3: urllib3: Denial of Service due to excessive HTTP response decompression mariadb: Arbitrary code execution via improper parameter validation during SST mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd</p> <p>mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer mariadb: MariaDB server: Information disclosure of stored routine definitions due to insufficient privilege check mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine mariadb: mbstream: Unauthorized file creation via path traversal mariadb: MariaDB: Privilege bypass allows unauthorized file write via subqueries urllib3: urllib3: Denial of Service due to excessive HTTP response decompression mariadb: Arbitrary code execution via improper parameter validation during SST mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd</p> https://cve.radiocsirt.org/vuln/rhsa-2026:25143 https://cve.radiocsirt.org/vuln/rlsa-2026:33093 <p><strong>Affected:</strong> Rocky Linux:10: mariadb10.11</p> <p>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.</p> <p>Security Fix(es):</p> <p>* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: mariadb10.11</p> <p>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.</p> <p>Security Fix(es):</p> <p>* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:33093 https://cve.radiocsirt.org/vuln/suse-su-2026:22095-1 <p>Security update for mariadb</p> <p>Security update for mariadb</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22095-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44168 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mariadb-10.0, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3, Ubuntu:22.04:LTS: mariadb-10.6, Ubuntu:24.04:LTS: mariadb, Ubuntu:25.10: mariadb, Ubuntu:26.04:LTS: mariadb</p> <p>MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mariadb-10.0, Ubuntu:18.04:LTS: mariadb-10.1, Ubuntu:20.04:LTS: mariadb-10.3, Ubuntu:22.04:LTS: mariadb-10.6, Ubuntu:24.04:LTS: mariadb, Ubuntu:25.10: mariadb, Ubuntu:26.04:LTS: mariadb</p> <p>MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44168 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1597 <p>Ein Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in MariaDB ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1597