{"schema_version":"1","data":[{"id":50388,"advisory_id":"6f83450d-6957-4428-9d72-9894a55af42c","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114487","source_published_at":"2026-10-22T15:48:35.922+00:00","published_at":"2026-10-25T14:05:47.143406+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-114487"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-114487","summary":"Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.","evidence":"cve:CVE-2026-114487","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Server","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-114487","aliases":["CVE-2026-114487"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"2026.3.5.0","lessThan":"2026.3.11","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.2.21","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T15:48:35.922Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0037/"],"provider_metadata":{"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-22T15:48:35.922Z"}}},"related_cves":[{"value":"CVE-2026-114487","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50385,"advisory_id":"40de6b9d-5dd1-4474-ab15-804e167beb46","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114486","source_published_at":"2026-10-22T15:38:55.177+00:00","published_at":"2026-10-25T14:05:45.189034+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-114486"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-114486","summary":"Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.","evidence":"cve:CVE-2026-114486","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-114486","aliases":["CVE-2026-114486"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.3.11","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T15:38:55.177Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0037/"],"provider_metadata":{"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-22T15:38:55.177Z"}}},"related_cves":[{"value":"CVE-2026-114486","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":50384,"advisory_id":"1232344c-f6cd-4f1d-b4fe-9a6fa36b58db","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114485","source_published_at":"2026-10-22T15:37:16.071+00:00","published_at":"2026-10-25T14:05:44.510167+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-114485"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-114485","summary":"Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.","evidence":"cve:CVE-2026-114485","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-114485","aliases":["CVE-2026-114485"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.3.11","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-22T15:37:16.071Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0037/"],"provider_metadata":{"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-22T15:37:16.071Z"}}},"related_cves":[{"value":"CVE-2026-114485","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":45043,"advisory_id":"accca21b-3482-4c19-95ea-540a2f5388b9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92262","source_published_at":"2026-10-16T16:25:46.964+00:00","published_at":"2026-10-25T12:26:39.371472+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-92262"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-92262","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-92262","aliases":["CVE-2026-92262"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-21T02:28:14.389Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40362"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92262","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T02:27:59.402947Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T02:28:14.389Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:25:46.964Z"}}},"related_cves":[{"value":"CVE-2026-92262","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"context_update":false},{"id":38833,"advisory_id":"f39746c0-0efd-4522-b999-c7cc38ddd016","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86047","source_published_at":"2026-10-16T16:37:04.254+00:00","published_at":"2026-10-25T10:35:56.776078+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-86047"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Insufficient quoting in mariadb-dump and SHOW commands","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-86047","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-86047","aliases":["CVE-2026-86047"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-19T12:42:14.961Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-86047","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-19T12:41:30.519558Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T12:42:14.961Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:37:04.254Z"}}},"related_cves":[{"value":"CVE-2026-86047","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":38831,"advisory_id":"569e5489-2cee-4aab-bad1-b688a4992f23","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85745","source_published_at":"2026-10-16T16:30:30.866+00:00","published_at":"2026-10-25T10:35:55.524217+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-85745"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-85745","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-85745","aliases":["CVE-2026-85745"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-19T12:39:16.848Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40328"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85745","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T12:38:54.237600Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T12:39:16.848Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:30:30.866Z"}}},"related_cves":[{"value":"CVE-2026-85745","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":32839,"advisory_id":"ee2b83b5-544d-4f87-8d54-a73766c32b2a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85985","source_published_at":"2026-10-16T16:21:14.677+00:00","published_at":"2026-10-25T08:56:08.533819+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-85985"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Unauthorized file access via CONNECT engine UDFs","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-85985","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-85985","aliases":["CVE-2026-85985"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-16T17:05:42.975Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40323"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85985","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T16:49:34.979927Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:05:42.975Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:21:14.677Z"}}},"related_cves":[{"value":"CVE-2026-85985","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":32838,"advisory_id":"1d032a23-9f5e-41f8-9c6a-d88e2da4c9fe","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85746","source_published_at":"2026-10-16T16:27:36.763+00:00","published_at":"2026-10-25T08:56:07.939074+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-85746"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-85746","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-85746","aliases":["CVE-2026-85746"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-16T17:05:31.146Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40329"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85746","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T16:49:55.618818Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T17:05:31.146Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:27:36.763Z"}}},"related_cves":[{"value":"CVE-2026-85746","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"context_update":false},{"id":32758,"advisory_id":"44c5ddaa-2bbc-4ce0-a850-dae92c87fdee","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85748","source_published_at":"2026-10-16T16:28:55.829+00:00","published_at":"2026-10-25T08:54:26.398041+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-85748"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Use-after-free with a large number of SYS_REFCURSOR's","summary":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.","evidence":"cve:CVE-2026-85748","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-85748","aliases":["CVE-2026-85748"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-16T16:54:40.841Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85748","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T16:54:30.361781Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T16:54:40.841Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:28:55.829Z"}}},"related_cves":[{"value":"CVE-2026-85748","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"context_update":false},{"id":32719,"advisory_id":"52e53cf7-89db-4d80-8042-efdbcde07185","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97380","source_published_at":"2026-10-16T16:23:07.975+00:00","published_at":"2026-10-25T08:54:03.017271+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-97380"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-97380","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-97380","aliases":["CVE-2026-97380"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-16T16:23:07.975Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40470"],"provider_metadata":{"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T16:23:07.975Z"}}},"related_cves":[{"value":"CVE-2026-97380","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":32597,"advisory_id":"b79f1d16-2d94-4f2f-b686-5e590d620be8","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110805","source_published_at":"2026-10-16T13:46:53.212+00:00","published_at":"2026-10-25T08:52:09.335056+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-110805"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-110805","summary":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.","evidence":"cve:CVE-2026-110805","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-110805","aliases":["CVE-2026-110805"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.3.10","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T15:08:11.754Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0036/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":2.6,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-110805","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:07:50.474633Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T15:08:11.754Z"}}],"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-16T13:46:53.212Z"}}},"related_cves":[{"value":"CVE-2026-110805","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":32596,"advisory_id":"25a520ed-aef4-46ef-b763-d860294c7faa","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110804","source_published_at":"2026-10-16T13:45:38.143+00:00","published_at":"2026-10-25T08:52:08.652525+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-110804"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-110804","summary":"Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.","evidence":"cve:CVE-2026-110804","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-110804","aliases":["CVE-2026-110804"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.3.10","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T15:08:54.643Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0036/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-110804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:08:51.366584Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T15:08:54.643Z"}}],"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-16T13:45:38.143Z"}}},"related_cves":[{"value":"CVE-2026-110804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":32595,"advisory_id":"04bf67c3-cfb6-40c0-8130-e6237d6f3817","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110806","source_published_at":"2026-10-16T13:44:20.481+00:00","published_at":"2026-10-25T08:52:08.012078+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-110806"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-110806","summary":"Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.","evidence":"cve:CVE-2026-110806","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-110806","aliases":["CVE-2026-110806"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.3.10","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T15:09:31.579Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0036/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-110806","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:09:28.202535Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T15:09:31.579Z"}}],"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-16T13:44:20.481Z"}}},"related_cves":[{"value":"CVE-2026-110806","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":32587,"advisory_id":"ade58849-24ae-484e-be41-49853af523d4","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110287","source_published_at":"2026-10-16T13:43:25.516+00:00","published_at":"2026-10-25T08:52:02.737169+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-110287"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-110287","summary":"Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.","evidence":"cve:CVE-2026-110287","products":[{"name":{"value":"Server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-110287","aliases":["CVE-2026-110287"],"metrics":[],"affected":[{"vendor":"Devolutions","product":"Server","versions":[{"status":"affected","version":"0","lessThan":"2026.3.10","versionType":"custom"}],"defaultStatus":"unaffected"}],"modified":"2026-10-16T15:10:08.692Z","provider":"cve","references":["https://devolutions.net/security/advisories/DEVO-2026-0036/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-110287","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:10:03.798886Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-16T15:10:08.692Z"}}],"cna":{"orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","shortName":"DEVOLUTIONS","dateUpdated":"2026-10-16T13:43:25.516Z"}}},"related_cves":[{"value":"CVE-2026-110287","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":22018,"advisory_id":"9f23c732-5bbf-4662-a427-5d887b1b5415","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102603","source_published_at":"2026-10-13T14:21:20.867+00:00","published_at":"2026-10-25T05:54:30.362104+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-102603"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Gotify: Insufficiently Protected Password Change endpoint","summary":"Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.","evidence":"cve:CVE-2026-102603","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102603","aliases":["CVE-2026-102603"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"gotify","product":"server","versions":[{"status":"affected","version":"< 3.0.0"}]}],"modified":"2026-10-14T14:45:36.133Z","provider":"cve","references":["https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9","https://github.com/gotify/server/pull/952","https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9","https://github.com/gotify/server/releases/tag/v3.0.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102603","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T14:43:27.030912Z"}}}],"references":[{"url":"https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T14:45:36.133Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-13T14:21:20.867Z"}}},"related_cves":[{"value":"CVE-2026-102603","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":21358,"advisory_id":"cdbcd2d9-7a1e-4dad-a1a5-0ab349024016","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107818","source_published_at":"2026-10-09T17:23:58.543+00:00","published_at":"2026-10-25T05:43:25.012635+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107818"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: environment injection via wsrep bootstrap in the mariadb.service file","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107818","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107818","aliases":["CVE-2026-107818"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-14T02:02:34.303Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40629"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107818","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-14T02:02:24.799855Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T02:02:34.303Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:23:58.543Z"}}},"related_cves":[{"value":"CVE-2026-107818","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":20793,"advisory_id":"da382631-94ec-400c-b921-d5088b23afe2","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107822","source_published_at":"2026-10-09T17:28:47.578+00:00","published_at":"2026-10-25T05:34:14.496928+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107822"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: database privilege escalation via user / role name collision in the acl cache","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107822","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107822","aliases":["CVE-2026-107822"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-13T20:27:06.868Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40541"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107822","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T20:14:30.442609Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T20:27:06.868Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:28:47.578Z"}}},"related_cves":[{"value":"CVE-2026-107822","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":20792,"advisory_id":"51fa5bb5-e543-458d-b935-33c7310c47bb","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107816","source_published_at":"2026-10-09T17:19:00.365+00:00","published_at":"2026-10-25T05:34:13.920642+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107816"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: `qc_info` plugin can do OOB reads if query contains \\0","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107816","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107816","aliases":["CVE-2026-107816"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-13T20:27:21.152Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40670"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107816","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T20:13:34.743204Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T20:27:21.152Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:19:00.365Z"}}},"related_cves":[{"value":"CVE-2026-107816","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":20512,"advisory_id":"7c9b41d4-0a2b-4767-a033-97c0620c4c28","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107823","source_published_at":"2026-10-09T17:30:36.062+00:00","published_at":"2026-10-25T05:29:26.82842+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107823"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: privilege escalation via incorrect view frm parsing","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107823","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107823","aliases":["CVE-2026-107823"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-13T17:04:53.917Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40484"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107823","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T17:04:40.331253Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T17:04:53.917Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:30:36.062Z"}}},"related_cves":[{"value":"CVE-2026-107823","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":20510,"advisory_id":"c34e43b9-cd19-4dc0-8f65-342dc20cb410","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107817","source_published_at":"2026-10-09T17:22:19.29+00:00","published_at":"2026-10-25T05:29:25.667895+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107817"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: mysql_json plugin OOB reads","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107817","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107817","aliases":["CVE-2026-107817"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-13T17:04:02.004Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc","https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40678"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107817","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T17:03:46.950457Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T17:04:02.004Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:22:19.290Z"}}},"related_cves":[{"value":"CVE-2026-107817","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":20509,"advisory_id":"0b916f2d-3253-494e-a89f-90e35895e5bf","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107815","source_published_at":"2026-10-09T16:05:49.046+00:00","published_at":"2026-10-25T05:29:25.055392+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107815"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: one byte OOB write in DOS tables of the CONNECT engine","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107815","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107815","aliases":["CVE-2026-107815"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-13T17:01:48.035Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40637"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107815","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T17:01:21.434545Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T17:01:48.035Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T16:05:49.046Z"}}},"related_cves":[{"value":"CVE-2026-107815","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":16433,"advisory_id":"8c754c12-2356-4602-8834-bc1ef963c66b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107819","source_published_at":"2026-10-09T17:25:45.082+00:00","published_at":"2026-10-25T01:16:19.257601+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107819"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure","summary":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.","evidence":"cve:CVE-2026-107819","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-107819","aliases":["CVE-2026-107819"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 3.4.1, < 3.4.10"}]}],"modified":"2026-10-09T17:59:15.334Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107819","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T17:59:07.078424Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T17:59:15.334Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:25:45.082Z"}}},"related_cves":[{"value":"CVE-2026-107819","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":16410,"advisory_id":"51445488-1891-4c0a-9792-6aa811c6a0f2","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107821","source_published_at":"2026-10-09T17:27:16.316+00:00","published_at":"2026-10-25T01:16:06.124114+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107821"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: insufficient validation of binary frm data when opening a table","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107821","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107821","aliases":["CVE-2026-107821"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-09T17:42:29.482Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://jira.mariadb.org/browse/MDEV-40571"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107821","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-09T17:42:08.587821Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T17:42:29.482Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T17:27:16.316Z"}}},"related_cves":[{"value":"CVE-2026-107821","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":16371,"advisory_id":"885a5544-da18-4928-826b-0a7e439a69f8","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107814","source_published_at":"2026-10-09T16:02:25.544+00:00","published_at":"2026-10-25T01:15:43.360017+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-107814"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","evidence":"cve:CVE-2026-107814","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-107814","aliases":["CVE-2026-107814"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"MariaDB","product":"server","versions":[{"status":"affected","version":">= 10.6.1, < 10.6.28"},{"status":"affected","version":">= 10.11.1, < 10.11.19"},{"status":"affected","version":">= 11.4.1, < 11.4.13"},{"status":"affected","version":">= 11.8.1, < 11.8.9"},{"status":"affected","version":">= 12.3.1, < 12.3.3"},{"status":"affected","version":">= 13.0.1, < 13.0.2"}]}],"modified":"2026-10-09T16:45:15.295Z","provider":"cve","references":["https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw","https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-107814","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-09T16:16:12.667573Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-09T16:45:15.295Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-09T16:02:25.544Z"}}},"related_cves":[{"value":"CVE-2026-107814","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":12913,"advisory_id":"c6a71395-e0a7-4b45-91e6-5d1d25d241aa","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82246","source_published_at":"2026-08-28T10:49:32.768+00:00","published_at":"2026-10-25T00:15:49.316272+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-82246"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Budibase Server before 3.41.3 SSRF via Query Import","summary":"Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints and other restricted network resources.","evidence":"cve:CVE-2026-82246","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82246","aliases":["CVE-2026-82246"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"budibase","product":"server","versions":[{"status":"affected","version":"0","lessThan":"3.41.3","versionType":"semver"},{"status":"unaffected","version":"3.41.3","versionType":"semver"}],"packageURL":"pkg:npm/%40budibase/server","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:28.615Z","provider":"cve","references":["https://github.com/Budibase/budibase/security/advisories/GHSA-48x3-9ph2-p9gj","https://www.vulncheck.com/advisories/budibase-server-before-3.41.3-ssrf-via-query-import"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82246","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-28T14:44:59.829935Z"}}}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-48x3-9ph2-p9gj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-28T14:45:27.847Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:28.615Z"}}},"related_cves":[{"value":"CVE-2026-82246","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":12912,"advisory_id":"1a96d340-38e1-4d9c-925c-e01dadff62d9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82245","source_published_at":"2026-08-28T10:49:32.098+00:00","published_at":"2026-10-25T00:15:48.761272+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-82245"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Budibase before 3.41.3 Missing Authorization License Management","summary":"Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/* endpoints to disable premium features and downgrade deployments for all users.","evidence":"cve:CVE-2026-82245","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82245","aliases":["CVE-2026-82245"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"budibase","product":"server","versions":[{"status":"affected","version":"0","lessThan":"3.41.3","versionType":"semver"},{"status":"unaffected","version":"3.41.3","versionType":"semver"}],"packageURL":"pkg:npm/%40budibase/server","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:27.957Z","provider":"cve","references":["https://github.com/Budibase/budibase/security/advisories/GHSA-4wr8-5c3p-rjcr","https://www.vulncheck.com/advisories/budibase-before-3.41.3-missing-authorization-license-management"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82245","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-28T15:14:33.742361Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-28T15:52:50.059Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:27.957Z"}}},"related_cves":[{"value":"CVE-2026-82245","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":12911,"advisory_id":"b9be8105-6c21-4821-b744-295cd6158bd7","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82244","source_published_at":"2026-08-28T10:49:31.426+00:00","published_at":"2026-10-25T00:15:48.185359+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-82244"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Budibase before 3.41.3 Remote Code Execution via Plugin eval()","summary":"Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.","evidence":"cve:CVE-2026-82244","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-82244","aliases":["CVE-2026-82244"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.4,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"budibase","product":"server","versions":[{"status":"affected","version":"0","lessThan":"3.41.3","versionType":"semver"},{"status":"unaffected","version":"3.41.3","versionType":"semver"}],"packageURL":"pkg:npm/%40budibase/server","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:26.887Z","provider":"cve","references":["https://github.com/Budibase/budibase/security/advisories/GHSA-gwr2-pgg3-p7xp","https://www.vulncheck.com/advisories/budibase-before-3.41.3-remote-code-execution-via-plugin-eval"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82244","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-28T15:40:01.032491Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-28T15:40:15.664Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:26.887Z"}}},"related_cves":[{"value":"CVE-2026-82244","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"context_update":false},{"id":12910,"advisory_id":"c6c4f95d-9871-4e12-a98e-825a42561143","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82243","source_published_at":"2026-08-28T10:49:30.744+00:00","published_at":"2026-10-25T00:15:47.609423+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-82243"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Budibase Server before 3.41.3 SSRF with Credential Leakage","summary":"Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments.","evidence":"cve:CVE-2026-82243","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82243","aliases":["CVE-2026-82243"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"budibase","product":"server","versions":[{"status":"affected","version":"0","lessThan":"3.41.3","versionType":"semver"},{"status":"unaffected","version":"3.41.3","versionType":"semver"}],"packageURL":"pkg:npm/%40budibase/server","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:26.045Z","provider":"cve","references":["https://github.com/Budibase/budibase/security/advisories/GHSA-83m5-fvmg-r7xv","https://www.vulncheck.com/advisories/budibase-server-before-3.41.3-ssrf-with-credential-leakage"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82243","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-31T18:31:10.475911Z"}}}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-83m5-fvmg-r7xv","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-31T18:31:42.022Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:26.045Z"}}},"related_cves":[{"value":"CVE-2026-82243","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":12909,"advisory_id":"d46c5b9e-9003-4166-96e0-2bf148c08d15","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82242","source_published_at":"2026-08-28T10:49:30.049+00:00","published_at":"2026-10-25T00:15:47.02303+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-82242"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization","summary":"Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. Attackers can inject resources by specifying an arbitrary destination workspace ID in the request body, then trigger injected automations with outgoing webhooks to exfiltrate data from victim applications.","evidence":"cve:CVE-2026-82242","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82242","aliases":["CVE-2026-82242"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"budibase","product":"server","versions":[{"status":"affected","version":"0","lessThan":"3.41.3","versionType":"semver"},{"status":"unaffected","version":"3.41.3","versionType":"semver"}],"packageURL":"pkg:npm/%40budibase/server","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:25.474Z","provider":"cve","references":["https://github.com/Budibase/budibase/security/advisories/GHSA-xqpq-288m-r5q7","https://www.vulncheck.com/advisories/budibase-before-3.41.3-cross-application-resource-injection-via-missing-authorization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82242","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-28T14:02:45.467649Z"}}}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-xqpq-288m-r5q7","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-28T14:02:53.417Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:25.474Z"}}},"related_cves":[{"value":"CVE-2026-82242","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false},{"id":12908,"advisory_id":"1009fe56-0f43-4903-abd7-a4f9bba7e5a5","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82241","source_published_at":"2026-08-28T10:49:29.355+00:00","published_at":"2026-10-25T00:15:46.454408+00:00","extraction_method":"structured","technologies":["core-cve","server"],"cve_ids":["CVE-2026-82241"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Budibase backend-core SSRF via incomplete default blacklist","summary":"Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST) used by REST datasource query previews. When the default blacklist is active (i.e., a self-hosted deployment has not defined BLACKLIST_IPS), an authenticated user with the Builder permission can submit a REST datasource query preview request to POST /api/queries/preview targeting a reachable HTTP(S) service in the 100.64.0.0/10 range, causing the server to send a request to that target and return its response through the preview flow. Per the advisory, no released fix was identified at the time of publication; remediation is to add 100.64.0.0/10 to DEFAULT_BLACKLIST.","evidence":"cve:CVE-2026-82241","products":[{"name":{"value":"server","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82241","aliases":["CVE-2026-82241"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"budibase","product":"server","versions":[{"status":"affected","version":"0","lessThan":"3.41.3","versionType":"semver"},{"status":"unaffected","version":"3.41.3","versionType":"semver"}],"packageURL":"pkg:npm/%40budibase/server","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:25:24.916Z","provider":"cve","references":["https://github.com/Budibase/budibase/security/advisories/GHSA-9754-4wm6-3c8r","https://www.vulncheck.com/advisories/budibase-backend-core-ssrf-via-incomplete-default-blacklist"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82241","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-28T14:46:47.075515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-28T14:46:56.389Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:25:24.916Z"}}},"related_cves":[{"value":"CVE-2026-82241","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"context_update":false}],"next_after":50388,"next_before":12908}