How many CVEs does MariaDB have?

MariaDB has 424 published CVE records since 2005, including 18 in the last two years.

How many MariaDB CVEs are in CISA KEV?

None of MariaDB's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which MariaDB products have the most CVEs?

The MariaDB products with the most published CVEs are MariaDB, server, connector/c, maxscale, model context protocol.

What are the most common weakness types in MariaDB CVEs?

MariaDB's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-1038 (Insecure Automated Optimizations), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for MariaDB vulnerabilities?

Yes — 26 of MariaDB's CVEs have a known public exploit.

How many critical MariaDB vulnerabilities are there?

MariaDB has 10 critical and 74 high-severity CVEs.

What is the average severity of MariaDB CVEs?

The average CVSS base score across MariaDB's scored CVEs is 5.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

424 CVEs

MariaDB Vulnerabilities

Name: MariaDB vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for MariaDB.

424

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

26

Public exploits

PoC or exploit code

5.4

Avg CVSS

2005–2026

Overview

MariaDB has 424 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 26 have a known public exploit. The average CVSS base score across scored CVEs is 5.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting MariaDB products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on MariaDB's vulnerability posture, as a share of its 424 published CVEs.

Average CVSS: 5.4
Critical / high: 20%
Actively exploited (KEV): 0%
Public exploit available: 6%
Patch available: 99%

Severity and exploitation

How the CVSS severity of MariaDB's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical10

High74

Medium291

Low49

In CISA’s Known Exploited Vulnerabilities catalog

0

None of MariaDB's CVEs are currently listed in CISA's KEV catalog.

Public exploits

26

26 of MariaDB's CVEs have a known public exploit available.

Most affected products

The MariaDB products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in MariaDB CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish MariaDB CVE records.

Disclosure activity by year

How many MariaDB CVEs were published each year.

2019

16

2020

17

2021

15

2022

59

2023

4

2024

3

2025

6

2026

12

Latest MariaDB CVEs

The most recently disclosed vulnerabilities affecting MariaDB.

MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner side
CWE-78
Critical · CVSS 9.1
EPSS 1.0%2026-06-12
MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)
CWE-78
Critical · CVSS 9.1
EPSS 0.7%2026-06-12
MariaDB: FILE privilege was not checked for subqueries in the FROM clause
CWE-863
High · CVSS 8.1
EPSS 0.4%2026-06-12
MariaDB: mysql_real_escape_string() incorrectly handled big5
CWE-89
Medium · CVSS 6.9
EPSS 0.3%2026-06-12
MariaDB: path traversal in mbstream
CWE-22
High · CVSS 7.8
EPSS 0.1%2026-06-12
MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions
CWE-863
Medium · CVSS 4.3
EPSS 0.2%2026-06-12
MariaDB: wsrep SST unsafe parameter handling on the donor side
CWE-78
High · CVSS 8.0
EPSS 0.6%2026-06-12
MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
CWE-78
Medium · CVSS 6.3
EPSS 0.8%2026-06-12
MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
CWE-78
Critical · CVSS 10.0
EPSS 1.0%2026-06-11
Medium vulnerability · 2026-04-03
CWE-789
Medium · CVSS 6.5
EPSS 0.3%2026-04-03
Heap-based Buffer Overflow in MariaDB
CWE-122
Critical · CVSS 9.9
EPSS 0.9%2026-03-20
MariaDB Server Audit Plugin Comment Handling Bypass
CWE-778
Medium · CVSS 5.3
EPSS 0.3%2026-03-03

Track new MariaDB CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor MariaDB CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

QEMU434 CVEs tensorflow434 CVEs cpanel429 CVEs Wikimedia Foundation429 CVEs GPAC426 CVEs Palo Alto Networks423 CVEs Rockwell Automation421 CVEs EMC421 CVEs

Browse all vendors

Frequently asked questions

Common questions about MariaDB vulnerabilities.

How many CVEs does MariaDB have?: MariaDB has 424 published CVE records since 2005, including 18 in the last two years.
How many MariaDB CVEs are in CISA KEV?: None of MariaDB's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which MariaDB products have the most CVEs?: The MariaDB products with the most published CVEs are MariaDB, server, connector/c, maxscale, model context protocol.
What are the most common weakness types in MariaDB CVEs?: MariaDB's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-1038 (Insecure Automated Optimizations), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for MariaDB vulnerabilities?: Yes — 26 of MariaDB's CVEs have a known public exploit.
How many critical MariaDB vulnerabilities are there?: MariaDB has 10 critical and 74 high-severity CVEs.
What is the average severity of MariaDB CVEs?: The average CVSS base score across MariaDB's scored CVEs is 5.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track MariaDB vulnerabilities

Monitor new MariaDB vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing