7
CVEs
0
Critical
0
High
0
KEV
7
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55855 | SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass. | MEDIUM | 6.5 | 0.3% | 53 |
PoC
|
| CVE-2026-55858 | Charset-confusion in MariaDB Connector/J (all branches prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows a server-side character set change mid-session to silently decouple the driver's UTF-8 encoding assumption from the server's active encoding. Because the driver continues escaping SQL string literals as UTF-8 while the server parses incoming bytes under a different multi-byte encoding (e.g., GBK or BIG5), the mismatch can defeat byte-wise SQL quoting and enable SQL injection - a well-documented attack class for charset-confusion primitives. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis. | MEDIUM | 5.9 | 0.3% | 50 |
PoC
|
| CVE-2026-55854 | PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches. | MEDIUM | 5.9 | 0.3% | 50 |
PoC
|
| CVE-2026-55859 | MariaDB Connector/R2DBC prior to 1.4.1 hardcodes UTF-8 for all character encoding and decoding but fails to reject mid-session charset changes announced by the server via the OK-packet session-state-tracking mechanism. A hostile or man-in-the-middle server, or server-side constructs such as stored routines, triggers, or server configuration, can shift character_set_client to a non-UTF-8 encoding after connection initialization, causing the driver and server to interpret identical bytes under different encodings. This produces silent data corruption and a charset-confusion mismatch that can undermine byte-wise quoting and escaping, creating a pathway to SQL injection in applications that rely on driver-level escaping; no public exploit has been identified at time of analysis and the vendor-released patch is available in version 1.4.1. | MEDIUM | 5.9 | 0.2% | 50 |
PoC
|
| CVE-2026-55856 | Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory. | MEDIUM | 5.9 | 0.2% | 50 |
PoC
|
| CVE-2026-55857 | MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments. | MEDIUM | 5.9 | 0.2% | 50 |
PoC
|
| CVE-2026-55860 | Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1. | MEDIUM | 5.9 | 0.1% | 50 |
PoC
|