{"id":"CVE-2026-107814","aliases":["BELL-CVE-2026-107814","BIT-mariadb-2026-107814","BIT-mariadb-min-2026-107814","BIT-mysql-client-2026-107814","EUVD-2026-95899","GHSA-m5gf-432r-g5jw","OESA-2026-4595","OESA-2026-4596","RHSA-2026:83108","RHSA-2026:84689","RHSA-2026:84701","UBUNTU-CVE-2026-107814","openSUSE-SU-2026:12245-1"],"status":"published","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00489,"percentile":0.42572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2026-10-09T16:02:25Z","modified":"2026-10-29T09:15:38Z","fixes":[{"ecosystem":"Alpaquita:23","package":"mariadb","fixed_in":["10.6.28-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"mariadb","fixed_in":["11.4.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"mariadb","fixed_in":["11.8.9-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb","fixed_in":["10.6.28","10.11.19","11.4.13","11.8.9","12.3.3","13.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb-min","fixed_in":["10.6.28","10.11.19","11.4.13","11.8.9","12.3.3","13.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mysql-client","fixed_in":["10.6.28","10.11.19","11.4.13","11.8.9","12.3.3","13.0.2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"mariadb","fixed_in":["10.11.19-2.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mariadb","fixed_in":["10.5.29-3.oe2203sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.6.12-r0"},{"fixed":"10.6.28-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.4.5-r0"},{"fixed":"11.4.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.11.4-r0"},{"fixed":"11.8.9-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"10.6.1"},{"fixed":"10.6.28"},{"introduced":"10.11.1"},{"fixed":"10.11.19"},{"introduced":"11.4.1"},{"fixed":"11.4.13"},{"introduced":"11.8.1"},{"fixed":"11.8.9"},{"introduced":"12.3.1"},{"fixed":"12.3.3"},{"introduced":"13.0.1"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.6.1"},{"fixed":"10.6.28"},{"introduced":"10.11.1"},{"fixed":"10.11.19"},{"introduced":"11.4.1"},{"fixed":"11.4.13"},{"introduced":"11.8.1"},{"fixed":"11.8.9"},{"introduced":"12.3.1"},{"fixed":"12.3.3"},{"introduced":"13.0.1"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mysql-client","ranges":[{"type":"SEMVER","events":[{"introduced":"10.6.1"},{"fixed":"10.6.28"},{"introduced":"10.11.1"},{"fixed":"10.11.19"},{"introduced":"11.4.1"},{"fixed":"11.4.13"},{"introduced":"11.8.1"},{"fixed":"11.8.9"},{"introduced":"12.3.1"},{"fixed":"12.3.3"},{"introduced":"13.0.1"},{"fixed":"13.0.2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.11.19-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.29-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-client-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-connect-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-cracklib-password-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-gssapi-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-oqgraph-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-rocksdb-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-s3-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-server-galera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-server-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-sphinx-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-client-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-connect-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-cracklib-password-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-duckdb-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-gssapi-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-oqgraph-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-rocksdb-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-s3-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-server-galera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-server-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-sphinx-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb11.8-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.8.9-0.1.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-client-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-connect-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-cracklib-password-check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-embedded-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-gssapi-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-oqgraph-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-rocksdb-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-s3-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-server-galera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-server-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-sphinx-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mariadb10.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.11.18-4.1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mariadb-10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.20-0ubuntu0.15.04.1","10.0.22-0ubuntu1","10.0.23-1","10.0.23-2","10.0.24-7","10.0.25-0ubuntu0.16.04.1","10.0.27-0ubuntu0.16.04.1","10.0.28-0ubuntu0.16.04.1","10.0.29-0ubuntu0.16.04.1","10.0.31-0ubuntu0.16.04.2","10.0.33-0ubuntu0.16.04.1","10.0.34-0ubuntu0.16.04.1","10.0.36-0ubuntu0.16.04.1","10.0.38-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mariadb-10.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.25-1","1:10.1.29-6","1:10.1.34-0ubuntu0.18.04.1","1:10.1.38-0ubuntu0.18.04.1","1:10.1.38-0ubuntu0.18.04.2","1:10.1.40-0ubuntu0.18.04.1","1:10.1.41-0ubuntu0.18.04.1","1:10.1.43-0ubuntu0.18.04.1","1:10.1.44-0ubuntu0.18.04.1","1:10.1.47-0ubuntu0.18.04.1","1:10.1.48-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mariadb-10.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.3.17-1","1:10.3.18-1","1:10.3.19-1","1:10.3.21-2","1:10.3.22-1","1:10.3.22-1ubuntu1","1:10.3.25-0ubuntu0.20.04.1","1:10.3.29-0ubuntu0.20.04.1","1:10.3.30-0ubuntu0.20.04.1","1:10.3.31-0ubuntu0.20.04.1","1:10.3.32-0ubuntu0.20.04.1","1:10.3.34-0ubuntu0.20.04.1","1:10.3.37-0ubuntu0.20.04.1","1:10.3.38-0ubuntu0.20.04.1","1:10.3.39-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mariadb-10.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.6.7-2ubuntu1","1:10.6.7-2ubuntu1.1","1:10.6.11-0ubuntu0.22.04.1","1:10.6.12-0ubuntu0.22.04.1","1:10.6.16-0ubuntu0.22.04.1","1:10.6.18-0ubuntu0.22.04.1","1:10.6.21-0ubuntu0.22.04.2","1:10.6.22-0ubuntu0.22.04.1","1:10.6.23-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.11.4-1","1:10.11.5-3","1:10.11.6-1","1:10.11.6-2","1:10.11.7-2ubuntu1","1:10.11.7-2ubuntu2","1:10.11.8-0ubuntu0.24.04.1","1:10.11.11-0ubuntu0.24.04.2","1:10.11.13-0ubuntu0.24.04.1","1:10.11.14-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.8.6-5","1:11.8.8-1","1:11.8.9+ds-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.8.3-1build1","1:11.8.5-1","1:11.8.5-2","1:11.8.5-3","1:11.8.5-4","1:11.8.6-1","1:11.8.6-3","1:11.8.6-4","1:11.8.6-5","1:11.8.6-5ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.2-3.1"}]}],"bundled":22}],"products":[{"vendor":"devolutions","product":"server"},{"vendor":"mariadb","product":"mariadb"},{"vendor":"mariadb","product":"server"}],"references":[{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","tags":["x_refsource_MISC","Release Notes","article","web","report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-107814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107814.json","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4595","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4596","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83108","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107814","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107815","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107816","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107817","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107818","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107821","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107822","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107823","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83108.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107814","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40637","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548739","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40670","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107817","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/851f52470d470a96a66e0b7e5599f3b6c2e45907","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-89ph-64cf-gqcc","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40678","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40629","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548734","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40571","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40541","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40484","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97380","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86047","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85985","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85745","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84689.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553280","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","tags":["advisory"]},{"url":"https://hackerone.com/reports/3856148","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40328","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85985","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40323","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554208","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","tags":["article"]},{"url":"https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","tags":["article"]},{"url":"https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","tags":["article"]},{"url":"https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","tags":["article"]},{"url":"https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-39776","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-39818","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40308","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40311","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40312","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","tags":["advisory"]},{"url":"https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","tags":["article"]},{"url":"https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","tags":["article"]},{"url":"https://jira.mariadb.org/browse/MDEV-40470","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84701","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84701.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-107814","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-107823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97380","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-107814","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-09T16:02:25.544Z","modified":"2026-10-09T16:45:15.295Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-95899","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-09T16:02:25Z","modified":"2026-10-09T16:45:15Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:24.64208Z"}],"nvd":[{"id":"CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-09T16:17:26.15Z","modified":"2026-10-14T14:12:32.08Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:12:55.473789Z"}],"osv":[{"id":"BELL-CVE-2026-107814","status":"published","published":"2026-10-10T06:05:10.435048Z","modified":"2026-10-17T07:15:05.640660929Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-107814","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-09T16:02:25.544Z","modified":"2026-10-28T10:41:06.171668888Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"OESA-2026-4595","title":"mariadb security update","description":"MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.\r\n\r\nSecurity Fix(es):\n\nMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.(CVE-2026-107814)","status":"published","published":"2026-10-29T09:03:22Z","modified":"2026-10-29T09:15:38.588919751Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4596","title":"mariadb security update","description":"MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.\r\n\r\nSecurity Fix(es):\n\nMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.(CVE-2026-107814)","status":"published","published":"2026-10-29T09:03:23Z","modified":"2026-10-29T09:15:38.579581405Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:83108","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-15T10:28:54Z","modified":"2026-10-20T10:17:10Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84689","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-20T10:17:43Z","modified":"2026-10-20T10:43:37.347030984Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84701","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-20T10:17:44Z","modified":"2026-10-20T10:43:37.146162618Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-09T16:17:00Z","modified":"2026-10-17T12:58:02.806040924Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"BIT-mariadb-2026-107814","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T08:41:53.303Z","modified":"2026-10-16T09:55:53.65259849Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mariadb-min-2026-107814","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T08:41:59.155Z","modified":"2026-10-16T09:55:53.65259849Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mysql-client-2026-107814","title":"MariaDB: Insecure $HOME in MariaDB rpm packages","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","status":"published","published":"2026-10-16T08:44:14.159Z","modified":"2026-10-16T09:55:53.65259849Z","updated_at":"2026-11-02T15:28:33.469426Z"},{"id":"openSUSE-SU-2026:12245-1","title":"libmariadbd-devel-12.3.2-3.1 on GA media","description":"These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:11.303910676Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}