CVE-2026-92262Critical· 9.9▾ MidnightMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
server >= 10.6.1, < 10.6.28server >= 10.11.1, < 10.11.19server >= 11.4.1, < 11.4.13server >= 11.8.1, < 11.8.9server >= 12.3.1, < 12.3.3server >= 13.0.1, < 13.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85985Medium· 5.4MariaDB: Unauthorized file access via CONNECT engine UDFs
CVE-2026-85746Critical· 9.9MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
CVE-2026-86047High· 7.7MariaDB: Insufficient quoting in mariadb-dump and SHOW commands
CVE-2026-85745Medium· 4.3MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
CVE-2026-97380High· 8.8MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
CVE-2026-107822Medium· 6.4MariaDB server is a community developed fork of MySQL server