Mysql Connectors
Monthly
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 allows a low-privileged attacker with network access to compromise confidentiality, with a scope change that lets the attack significantly impact additional products beyond the connector itself. Fixed in the Oracle Critical Patch Update of July 2026 and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.7 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and there is no CISA KEV or EPSS signal in the provided data.
Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.
Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker who wins a high-complexity attack, with a scope change that lets the compromise significantly impact products beyond the connector itself. Oracle rates this CVSS 3.1 8.5 with high confidentiality, integrity, and availability impact, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise ("takeover") of Oracle's MySQL Connector/NET client library affects the ADO.NET data provider in MySQL Connectors versions 9.7.0 and 9.7.1, where an unauthenticated network attacker can seize control of the connector, impacting confidentiality, integrity, and availability of any .NET application relying on it. Rated CVSS 3.1 8.1 (High) with high attack complexity, this is a client-side flaw disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Oracle MySQL Connector/C++ (MySQL Connectors component) versions 9.7.0 through 9.7.1 allows an unauthenticated network attacker to trigger a hang or repeatable crash, causing a complete availability outage of the connector. The flaw is remotely and easily exploitable over multiple protocols with no user interaction, but has no confidentiality or integrity impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle MySQL Connectors (Connector/C++) versions 9.7.0 through 9.7.1 lets an unauthenticated remote attacker reach and tamper with all data accessible to the connector. The flaw is rated CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and is described by Oracle as difficult to exploit (high attack complexity). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in MySQL Connector/J 9.7.0-9.7.1 allows an unauthenticated remote attacker to crash or indefinitely hang the connector process via multiple protocols, contingent on human interaction from a victim. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), rating it CVSS 6.5. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting risk is currently theoretical rather than actively weaponized.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 allows a low-privileged attacker with network access to compromise confidentiality, with a scope change that lets the attack significantly impact additional products beyond the connector itself. Fixed in the Oracle Critical Patch Update of July 2026 and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.7 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and there is no CISA KEV or EPSS signal in the provided data.
Data compromise in Oracle MySQL Connectors (Connector/Net component) versions 9.7.0 through 9.7.1 allows a remote, unauthenticated attacker with network access via multiple protocols to read, create, delete, or modify all data accessible to the connector. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 base score of 7.4 with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and the high attack complexity (AC:H) tempers real-world exploitability.
Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker who wins a high-complexity attack, with a scope change that lets the compromise significantly impact products beyond the connector itself. Oracle rates this CVSS 3.1 8.5 with high confidentiality, integrity, and availability impact, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise ("takeover") of Oracle's MySQL Connector/NET client library affects the ADO.NET data provider in MySQL Connectors versions 9.7.0 and 9.7.1, where an unauthenticated network attacker can seize control of the connector, impacting confidentiality, integrity, and availability of any .NET application relying on it. Rated CVSS 3.1 8.1 (High) with high attack complexity, this is a client-side flaw disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Oracle MySQL Connector/C++ (MySQL Connectors component) versions 9.7.0 through 9.7.1 allows an unauthenticated network attacker to trigger a hang or repeatable crash, causing a complete availability outage of the connector. The flaw is remotely and easily exploitable over multiple protocols with no user interaction, but has no confidentiality or integrity impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle MySQL Connectors (Connector/C++) versions 9.7.0 through 9.7.1 lets an unauthenticated remote attacker reach and tamper with all data accessible to the connector. The flaw is rated CVSS 7.4 with high confidentiality and integrity impact but no availability impact, and is described by Oracle as difficult to exploit (high attack complexity). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in MySQL Connector/J 9.7.0-9.7.1 allows an unauthenticated remote attacker to crash or indefinitely hang the connector process via multiple protocols, contingent on human interaction from a victim. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), rating it CVSS 6.5. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting risk is currently theoretical rather than actively weaponized.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.