[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH-2jkYY2H3o8w0q3sga3ucJdlqwap6i7ls28MlPrHZU":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":36,"kevVulnerabilities":97,"topProductsByCves":98,"seoMetadata":103,"meta":112},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":35},18880,"mariadb",4,406,0,590,"2026-03-20","m",[16,20,26,31],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},106319,400,403,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},106318,"connector\\\u002Fc",31,1,"2020-05-20",{"id":27,"product_name":28,"version_count":29,"cve_count":24,"kev_count":11,"last_cve_update":30},106320,"maxscale",158,"2023-08-14",{"id":32,"product_name":33,"version_count":24,"cve_count":24,"kev_count":11,"last_cve_update":34},106321,"model_context_protocol","2025-09-10","Mariadb is a technology vendor with 4 tracked products and 406 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[37,46,52,59,64,68,74,79,87,92],{"cveId":38,"description":39,"publishedDate":40,"cvssScore":41,"cvssVersion":42,"severity":43,"isKev":44,"epssScore":45},"CVE-2014-0195","The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.","2014-06-05",6.8,"v2","Medium",false,0.99977,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":50,"cvssVersion":42,"severity":43,"isKev":44,"epssScore":51},"CVE-2012-2122","sql\u002Fpassword.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.","2012-06-26",5.1,0.965,{"cveId":53,"description":54,"publishedDate":40,"cvssScore":55,"cvssVersion":56,"severity":57,"isKev":44,"epssScore":58},"CVE-2014-0224","OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.",7.4,"v3.1","High",0.95326,{"cveId":60,"description":61,"publishedDate":40,"cvssScore":62,"cvssVersion":42,"severity":43,"isKev":44,"epssScore":63},"CVE-2014-0221","The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.",4.3,0.87892,{"cveId":65,"description":66,"publishedDate":40,"cvssScore":62,"cvssVersion":42,"severity":43,"isKev":44,"epssScore":67},"CVE-2014-3470","The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.",0.85784,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":72,"cvssVersion":56,"severity":57,"isKev":44,"epssScore":73},"CVE-2022-0778","The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).","2022-03-15",7.5,0.73188,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":72,"cvssVersion":42,"severity":57,"isKev":44,"epssScore":78},"CVE-2009-4484","Multiple stack-based buffer overflows in the CertDecoder::GetName function in src\u002Fasn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a.","2009-12-30",0.69552,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":84,"severity":85,"isKev":44,"epssScore":86},"CVE-2016-6662","Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.","2016-09-20",9.8,"v3.0","Critical",0.6773,{"cveId":88,"description":89,"publishedDate":90,"cvssScore":72,"cvssVersion":56,"severity":57,"isKev":44,"epssScore":91},"CVE-2018-25032","zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.","2022-03-25",0.51733,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":62,"cvssVersion":42,"severity":43,"isKev":44,"epssScore":96},"CVE-2014-0198","The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.","2014-05-06",0.43828,[],[99,100,101,102],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},{"id":27,"product_name":28,"version_count":29,"cve_count":24,"kev_count":11,"last_cve_update":30},{"id":32,"product_name":33,"version_count":24,"cve_count":24,"kev_count":11,"last_cve_update":34},{"title":104,"metaDescription":105,"keywords":106,"structuredData":107},"Mariadb - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Mariadb covering 4 products with 406 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Mariadb vulnerabilities, Mariadb security, Mariadb CVE, Mariadb threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":108,"@type":109,"name":110,"description":105,"url":111},"https:\u002F\u002Fschema.org","Organization","Mariadb","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fmariadb",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":113,"apiVersion":114},"2026-10-17T10:51:47.336Z","3.0"]