CVE-2026-107816
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
6.4
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-107816- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-95917
6.4
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
EUVD-2026-95917- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
NVD
6.4
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-107816- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVBELL-CVE-2026-107816
6.4
- Record
BELL-CVE-2026-107816- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
OSV
6.4
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-107816- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-107816
6.4
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
DEBIAN-CVE-2026-107816- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2026:83108
8.4
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:83108- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:84689
8.8
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:84689- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-107816
6.4
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
UBUNTU-CVE-2026-107816- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
OSVBIT-mariadb-2026-107816 No score
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-2026-107816- Updated
- 2026-11-02
OSVBIT-mariadb-min-2026-107816 No score
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mariadb-min-2026-107816- Updated
- 2026-11-02
OSVBIT-mysql-client-2026-107816 No score
MariaDB: `qc_info` plugin can do OOB reads if query contains \0
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
BIT-mysql-client-2026-107816- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12245-1 No score
libmariadbd-devel-12.3.2-3.1 on GA media
These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12245-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mariadbAlpaquita:23 |
10.6.12-r0 up to 10.6.28-r0 | 10.6.28-r0 |
mariadbAlpaquita:25 |
11.4.5-r0 up to 11.4.13-r0 | 11.4.13-r0 |
mariadbAlpaquita:stream |
10.11.4-r0 up to 11.8.9-r0 | 11.8.9-r0 |
mariadbBitnami |
10.6.1 up to 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, 13.0.1 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadb-minBitnami |
10.6.1 up to 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, 13.0.1 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mysql-clientBitnami |
10.6.1 up to 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, 13.0.1 up to 13.0.2 | 10.6.2810.11.1911.4.1311.8.912.3.313.0.2 |
mariadbDebian:12 |
All versions, plus listed versions 1:10.11.11-0+deb12u11:10.11.13-0+deb12u11:10.11.14-0+deb12u11:10.11.14-0+deb12u21:10.11.18-0+deb12u1 Show 45 moreShow less1:10.11.19-0+deb12u11:10.11.3-11:10.11.3-2~exp11:10.11.4-11:10.11.4-1~deb12u11:10.11.5-11:10.11.5-21:10.11.5-31:10.11.6-0+deb12u11:10.11.6-11:10.11.6-21:10.11.6-2.1~exp11:10.11.7-11:10.11.7-21:10.11.7-31:10.11.7-41:10.11.8-11:10.11.9-0+deb12u11:11.4.2-11:11.4.2-21:11.4.2-31:11.4.2-41:11.4.3-11:11.4.4-11:11.4.4-21:11.4.4-31:11.4.5-11:11.4.5-2~exp11:11.8.1-11:11.8.1-21:11.8.1-31:11.8.1-41:11.8.1-51:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-3 |
None known |
mariadbDebian:13 |
All versions, plus listed versions 1:11.8.2-11:11.8.3-0+deb13u11:11.8.3-11:11.8.5-11:11.8.5-2 Show 18 moreShow less1:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-0+deb13u11:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-0+deb13u11:11.8.8-11:11.8.9+ds-11:11.8.9+ds-21:11.8.9+ds-31:11.8.9+ds-4 |
None known |
mariadbDebian:14 |
before 1:11.8.9+ds-1, plus listed versions 1:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-3 Show 11 moreShow less1:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-1 |
1:11.8.9+ds-1 |
mariadb10.11Red Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
Show 48 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mariadb10.11-backupRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-client-utilsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-commonRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-connect-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-cracklib-password-checkRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-develRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-embeddedRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-embedded-develRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-errmsgRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-gssapi-serverRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-oqgraph-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-pamRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-rocksdb-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-s3-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-serverRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-server-galeraRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-server-utilsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-sphinx-engineRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb10.11-testRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:10.11.18-4.1.hum1 | 0:10.11.18-4.1.hum1 |
mariadb11.8Red Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-backupRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-client-utilsRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-commonRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-connect-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-cracklib-password-checkRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-develRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-duckdb-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-embeddedRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-embedded-develRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-errmsgRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-gssapi-serverRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-oqgraph-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-pamRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-rocksdb-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-s3-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-serverRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-server-galeraRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-server-utilsRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-sphinx-engineRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb11.8-testRed Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:11.8.9-0.1.hum1 | 0:11.8.9-0.1.hum1 |
mariadb-10.0Ubuntu:16.04:LTS |
All versions, plus listed versions 10.0.20-0ubuntu0.15.04.110.0.22-0ubuntu110.0.23-110.0.23-210.0.24-7 Show 9 moreShow less10.0.25-0ubuntu0.16.04.110.0.27-0ubuntu0.16.04.110.0.28-0ubuntu0.16.04.110.0.29-0ubuntu0.16.04.110.0.31-0ubuntu0.16.04.210.0.33-0ubuntu0.16.04.110.0.34-0ubuntu0.16.04.110.0.36-0ubuntu0.16.04.110.0.38-0ubuntu0.16.04.1 |
None known |
mariadb-10.1Ubuntu:18.04:LTS |
All versions, plus listed versions 10.1.25-11:10.1.29-61:10.1.34-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.2 Show 6 moreShow less1:10.1.40-0ubuntu0.18.04.11:10.1.41-0ubuntu0.18.04.11:10.1.43-0ubuntu0.18.04.11:10.1.44-0ubuntu0.18.04.11:10.1.47-0ubuntu0.18.04.11:10.1.48-0ubuntu0.18.04.1 |
None known |
mariadb-10.3Ubuntu:20.04:LTS |
All versions, plus listed versions 1:10.3.17-11:10.3.18-11:10.3.19-11:10.3.21-21:10.3.22-1 Show 10 moreShow less1:10.3.22-1ubuntu11:10.3.25-0ubuntu0.20.04.11:10.3.29-0ubuntu0.20.04.11:10.3.30-0ubuntu0.20.04.11:10.3.31-0ubuntu0.20.04.11:10.3.32-0ubuntu0.20.04.11:10.3.34-0ubuntu0.20.04.11:10.3.37-0ubuntu0.20.04.11:10.3.38-0ubuntu0.20.04.11:10.3.39-0ubuntu0.20.04.2 |
None known |
mariadb-10.6Ubuntu:22.04:LTS |
All versions, plus listed versions 1:10.6.7-2ubuntu11:10.6.7-2ubuntu1.11:10.6.11-0ubuntu0.22.04.11:10.6.12-0ubuntu0.22.04.11:10.6.16-0ubuntu0.22.04.1 Show 4 moreShow less1:10.6.18-0ubuntu0.22.04.11:10.6.21-0ubuntu0.22.04.21:10.6.22-0ubuntu0.22.04.11:10.6.23-0ubuntu0.22.04.1 |
None known |
mariadbUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.11.4-11:10.11.5-31:10.11.6-11:10.11.6-21:10.11.7-2ubuntu1 Show 5 moreShow less1:10.11.7-2ubuntu21:10.11.8-0ubuntu0.24.04.11:10.11.11-0ubuntu0.24.04.21:10.11.13-0ubuntu0.24.04.11:10.11.14-0ubuntu0.24.04.1 |
None known |
mariadbUbuntu:26.10 |
All versions, plus listed versions 1:11.8.6-51:11.8.8-11:11.8.9+ds-4ubuntu2 |
None known |
mariadbUbuntu:26.04:LTS |
All versions, plus listed versions 1:11.8.3-1build11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-4 Show 5 moreShow less1:11.8.6-11:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-5ubuntu0.1 |
None known |
mariadbopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 12.3.2-3.1 | 12.3.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107816 is a medium vulnerability (CVSS 6.4) in Devolutions Server, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in mariadb 10.6.28-r0.
References
github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6
github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e
github.com/MariaDB/server/releases/tag/mariadb-10.11.19
github.com/MariaDB/server/releases/tag/mariadb-10.6.28
github.com/MariaDB/server/releases/tag/mariadb-11.4.13
github.com/MariaDB/server/releases/tag/mariadb-11.8.9
Show 122 moreShow less
github.com/MariaDB/server/releases/tag/mariadb-12.3.3
github.com/MariaDB/server/releases/tag/mariadb-13.0.2
jira.mariadb.org/browse/MDEV-40670
docs.bell-sw.com/security/cves/CVE-2026-107816
nvd.nist.gov/vuln/detail/CVE-2026-107816
github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107816.json
security-tracker.debian.org/tracker/CVE-2026-107816
access.redhat.com/errata/RHSA-2026:83108
access.redhat.com/security/cve/CVE-2026-107814
access.redhat.com/security/cve/CVE-2026-107815
access.redhat.com/security/cve/CVE-2026-107816
access.redhat.com/security/cve/CVE-2026-107817
access.redhat.com/security/cve/CVE-2026-107818
access.redhat.com/security/cve/CVE-2026-107821
access.redhat.com/security/cve/CVE-2026-107822
access.redhat.com/security/cve/CVE-2026-107823
access.redhat.com/security/updates/classification
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83108.json
bugzilla.redhat.com/show_bug.cgi?id=2548712
cve.org/CVERecord?id=CVE-2026-107814
nvd.nist.gov/vuln/detail/CVE-2026-107814
github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2
github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw
bugzilla.redhat.com/show_bug.cgi?id=2548718
cve.org/CVERecord?id=CVE-2026-107815
nvd.nist.gov/vuln/detail/CVE-2026-107815
github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8
github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq
jira.mariadb.org/browse/MDEV-40637
bugzilla.redhat.com/show_bug.cgi?id=2548739
cve.org/CVERecord?id=CVE-2026-107816
bugzilla.redhat.com/show_bug.cgi?id=2548737
cve.org/CVERecord?id=CVE-2026-107817
nvd.nist.gov/vuln/detail/CVE-2026-107817
github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907
github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc
jira.mariadb.org/browse/MDEV-40678
bugzilla.redhat.com/show_bug.cgi?id=2548736
cve.org/CVERecord?id=CVE-2026-107818
nvd.nist.gov/vuln/detail/CVE-2026-107818
github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e
github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5
jira.mariadb.org/browse/MDEV-40629
bugzilla.redhat.com/show_bug.cgi?id=2548734
cve.org/CVERecord?id=CVE-2026-107821
nvd.nist.gov/vuln/detail/CVE-2026-107821
github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9
github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5
jira.mariadb.org/browse/MDEV-40571
bugzilla.redhat.com/show_bug.cgi?id=2548738
cve.org/CVERecord?id=CVE-2026-107822
nvd.nist.gov/vuln/detail/CVE-2026-107822
github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b
github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf
jira.mariadb.org/browse/MDEV-40541
bugzilla.redhat.com/show_bug.cgi?id=2548750
cve.org/CVERecord?id=CVE-2026-107823
nvd.nist.gov/vuln/detail/CVE-2026-107823
github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4
github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37
jira.mariadb.org/browse/MDEV-40484
access.redhat.com/errata/RHSA-2026:84689
access.redhat.com/security/cve/CVE-2026-97380
access.redhat.com/security/cve/CVE-2026-86047
access.redhat.com/security/cve/CVE-2026-85985
access.redhat.com/security/cve/CVE-2026-85745
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84689.json
bugzilla.redhat.com/show_bug.cgi?id=2553280
cve.org/CVERecord?id=CVE-2026-85745
nvd.nist.gov/vuln/detail/CVE-2026-85745
hackerone.com/reports/3856148
jira.mariadb.org/browse/MDEV-40328
bugzilla.redhat.com/show_bug.cgi?id=2554196
cve.org/CVERecord?id=CVE-2026-85985
nvd.nist.gov/vuln/detail/CVE-2026-85985
github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe
github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6
jira.mariadb.org/browse/MDEV-40323
bugzilla.redhat.com/show_bug.cgi?id=2554208
cve.org/CVERecord?id=CVE-2026-86047
nvd.nist.gov/vuln/detail/CVE-2026-86047
github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52
github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5
github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a
github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513
github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b
github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p
jira.mariadb.org/browse/MDEV-39776
jira.mariadb.org/browse/MDEV-39818
jira.mariadb.org/browse/MDEV-40308
jira.mariadb.org/browse/MDEV-40311
jira.mariadb.org/browse/MDEV-40312
bugzilla.redhat.com/show_bug.cgi?id=2554198
cve.org/CVERecord?id=CVE-2026-97380
nvd.nist.gov/vuln/detail/CVE-2026-97380
github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456
github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr
jira.mariadb.org/browse/MDEV-40470
ubuntu.com/security/CVE-2026-107816
suse.com/security/cve/CVE-2026-102523
suse.com/security/cve/CVE-2026-107814
suse.com/security/cve/CVE-2026-107815
suse.com/security/cve/CVE-2026-107816
suse.com/security/cve/CVE-2026-107817
suse.com/security/cve/CVE-2026-107818
suse.com/security/cve/CVE-2026-107821
suse.com/security/cve/CVE-2026-107822
suse.com/security/cve/CVE-2026-107823
suse.com/security/cve/CVE-2026-47023
suse.com/security/cve/CVE-2026-60184
suse.com/security/cve/CVE-2026-60331
suse.com/security/cve/CVE-2026-60585
suse.com/security/cve/CVE-2026-60747
suse.com/security/cve/CVE-2026-61081
suse.com/security/cve/CVE-2026-85745
suse.com/security/cve/CVE-2026-85746
suse.com/security/cve/CVE-2026-85748
suse.com/security/cve/CVE-2026-85985
suse.com/security/cve/CVE-2026-86047
suse.com/security/cve/CVE-2026-92262
suse.com/security/cve/CVE-2026-97380
Left out here: 8 versions. The JSON record has them.