Loading story…
dCERT issued advisories for multiple MariaDB vulnerabilities affecting database deployments, warning that the flaws can be exploited to cause denial of service and, in one case, potentially achieve code execution. Advisory 2026-0796 describes a MariaDB vulnerability with impact ranging from service disruption to possible arbitrary code execution, raising the risk for organizations that rely on the database for production workloads.
dCERT later published advisory 2026-0952 for an additional MariaDB vulnerability that can also be used to trigger denial of service conditions. The notices indicate a continuing stream of security issues affecting MariaDB availability and stability, underscoring the need for defenders to review affected versions, apply vendor fixes, and prioritize database systems that are exposed to untrusted users or network traffic.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-0952 for MariaDB, describing a vulnerability that allows denial of service.
dCERT published advisory 2026-0796 for MariaDB, stating that a vulnerability could allow denial of service and potentially code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MariaDB disclosed **CVE-2026-49261**, a command execution vulnerability in MariaDB Server tied to unsafe parameter handling in `wsrep_notify_cmd`. When that feature is enabled, shell commands embedded in the name of a joiner node can be executed by the server, creating a risk in Galera-based cluster environments where peer-supplied fields are substituted into shell commands without proper sanitization. The issue is also tracked as **GHSA-3p3m-4x7c-p4pw** and MariaDB internal ticket `MDEV-39721`. The vulnerability affects MariaDB versions `10.6.1` through `10.6.26`, `10.11.1` through `10.11.17`, `11.4.1` through `11.4.11`, `11.8.1` through `11.8.7`, and `12.3.1`. MariaDB released fixes in `10.6.27`, `10.11.18`, `11.4.12`, `11.8.8`, and `12.3.2`, and advised organizations that cannot patch immediately to disable `wsrep_notify_cmd`. The flaw was reported by **letchu_pkt**.
Jun 29, 2026
Two newly disclosed SQL injection vulnerabilities affect **WWBN AVideo Live Schedule Reminder** and the **OpenSTAManager Aggiornamenti** module, exposing organizations to severe database compromise. `CVE-2026-33651` is a blind SQL injection issue in AVideo rated **CVSS 8.1** that can let attackers exfiltrate the full database, including email addresses, personal information, and password hashes, while also modifying or deleting records through injected `UPDATE` or `DELETE` statements. Repeated time-based exploitation attempts could also degrade service performance by exhausting server connection pools. `CVE-2026-35168` affects OpenSTAManager and allows an authenticated attacker to execute arbitrary SQL with the privileges of the configured database user, undermining confidentiality, integrity, and availability. In MySQL or MariaDB deployments with broad database permissions, the flaw can enable schema changes, stored procedure tampering, and theft of sensitive financial data; where the database account has the `FILE` privilege, attackers can escalate from database access to **remote code execution** on the application server by writing arbitrary files to the host filesystem.
Jun 29, 2026
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as **MongoBleed**—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the `zlib` implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions `8.2.3`, `8.0.17`, `7.0.28`, `6.0.27`, `5.0.32`, and `4.4.30`, while end-of-life branches remain unpatched. A separate advisory disclosed a **critical Redis vulnerability** affecting `8.2.1` and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow **remote arbitrary code execution**, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as `6.2.20`, `7.2.11`, `7.4.6`, `8.0.4`, and `8.2.2`, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
Jun 29, 2026