MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 are affected by an SQL injection vulnerability. The issue arises because SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump commands do not consistently quote identifiers and values when serializing SQL, allowing a low-privileged attacker to inject SQL commands via crafted object identifiers or values. This vulnerability is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A buffer over-read vulnerability exists in MariaDB server's ST_Area function when processing invalid WKB for MultiPolygon geometries. This occurs because the multi-polygon parser advances past a nested geometry header without verifying sufficient input remains. The flaw affects multiple MariaDB versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. A low-privileged remote attacker can exploit this to disclose memory, potentially aiding in bypassing ASLR as part of a multi-vulnerability attack chain. The issue has been fixed in the stated fixed versions.
A use-after-free vulnerability (CWE-416) exists in MariaDB server versions 12.3.1 through before 12.3.3 and 13.0.1 through before 13.0.2 in the handling of SYS_REFCURSOR. This flaw allows a low-privileged attacker to open many SYS_REFCURSORs and trigger a use-after-free condition, potentially enabling remote code execution when combined with another vulnerability. The issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-85746 is a critical out-of-bounds write vulnerability in the MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs in the ST_AsText function when converting deeply nested GeometryCollections, where recursive WKT serialization fails to properly account for buffer size, leading to memory corruption. A low-privileged remote attacker can exploit this to potentially achieve code execution when combined with another vulnerability. The issue is fixed in the specified later versions.
CVE-2026-92262 is a critical vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves the #mysql50# prefix bypassing normal table-name filesystem encoding, allowing attackers to access files using legacy unencoded names. This can lead to crashes, data corruption, data exfiltration, or remote code execution. The issue is fixed in the specified later versions.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability in the GRANT PROXY statement. This flaw allows a low-privileged attacker who can name another account to change that account's password due to improper handling of an IDENTIFIED clause with an empty password. The issue is fixed in later versions.
A missing authorization vulnerability exists in the MariaDB server's CONNECT engine plugin file-access UDFs (json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file()) in certain versions. These functions do not enforce the FILE privilege or the secure_file_priv setting, allowing a low-privileged attacker to read or write files on the filesystem that the database account is not authorized to access, subject to OS permissions. The issue affects multiple MariaDB versions and has been fixed in later releases.
Gotify server versions prior to 3.0.0 have a vulnerability in the password change endpoint that allows an attacker with a valid client token to change a user's password without knowing the current password. This flaw requires administrator intervention or direct database access to recover the account. The issue is fixed in Gotify 3.0.0, which requires re-authentication with the current password to change it.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability due to improper validation of counts, offsets, lengths, and field boundaries in FRM metadata when opening binary FRM files. This can allow an attacker who can place a crafted FRM file in the data directory to cause out-of-bounds reads or writes, potentially crashing the server or executing arbitrary code. The issue is fixed in the versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A vulnerability in MariaDB server's view FRM parser allows improper encoding of newline characters in usernames. This flaw affects multiple MariaDB versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. An attacker with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges could craft a username that embeds additional view metadata, causing the parser to misinterpret it as security metadata and potentially escalate privileges. The issue is fixed in the stated fixed versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107818 is a high-severity vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves external control of system or configuration settings via the mariadb.service unit using the /run/mysqld/wsrep-new-cluster file during service restart. A database user with FILE privilege and appropriate secure-file-priv settings could create this file and inject attacker-controlled environment variables, potentially compromising confidentiality, integrity, and availability. The issue is fixed in the stated versions.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-107816 is an out-of-bounds read vulnerability in the MariaDB server's qc_info plugin affecting multiple versions from 10.6.1 through versions prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs when a query containing embedded null bytes is cached, and subsequent reading of information_schema.query_cache_info may access memory beyond the allocated buffer, potentially disclosing adjacent memory or causing a server crash. The issue has been fixed in the specified later versions.
An out-of-bounds write vulnerability exists in the MariaDB server's CONNECT engine DOS table type in certain versions. This flaw allows an authenticated user with CONNECT engine access to write a null byte beyond a stack buffer boundary, potentially causing a crash or remote code execution. The issue affects multiple MariaDB versions starting from 10.6.1 up to but not including fixed versions such as 10.6.28 and others. The vulnerability has a high severity score of 8.5 and is addressed in specific patched versions.
Budibase server versions 3.41.0 up to but not including 3.45.0 contain a critical authentication bypass vulnerability in the OIDC/SSO login path. The flaw allows an attacker who can register at a trusted IdP to claim a pending user invite by asserting the victim's invited email address without proper validation of the invite code or email verification. This enables the attacker to inherit all privileges granted to the invite, including admin rights, leading to full tenant compromise and denial of onboarding to the legitimate invitee.
CVE-2026-100683 is a high-severity SQL injection vulnerability in Budibase server versions before 3.45.0. It arises from improper neutralization of special characters in SQL commands when renaming database columns via the Budibase UI. An attacker with DDL rights on a connected MySQL or MSSQL datasource can exploit this to execute arbitrary SQL statements with the privileges of Budibase's datasource user. This allows unauthorized reads, writes, or destructive operations on the connected database, bypassing Budibase's permission model. The issue is fixed in version 3.45.0.
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.
Sync-in Server versions prior to 2.4.0 contain a vulnerability in the sync diff endpoint where user-supplied strings are compiled into regular expressions without complexity validation. This can lead to catastrophic backtracking patterns that block the Node.js event loop, causing the server to become unresponsive until restarted. The issue is patched in version 2.4.0.
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.