Database

In MariaDB Server versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1 a high severity vulnerability CVE-2026-48165 was detected. This vulnerability allows a high-privileged MariaDB user to execute arbitrary shell commands with the privileges of the mariadbd process on the galera joiner node. This occurs due to improper handling of the wsrep_sst_receive_address or wsrep_sst_donor global system variables. To address this issue, users should upgrade MariaDB Server to versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-48165.

In SQLite versions before 3.53.2 a high severity vulnerability CVE-2026-11824 was detected. This vulnerability allows an attacker to cause a Denial of Service (crash) or potentially execute arbitrary code. This occurs due to a heap-based buffer overflow in the FTS5 full-text search extension (specifically within the fts5ChunkIterate() function). By supplying a specially crafted database with malicious continuation page metadata (where the szLeaf value is smaller than 4), an attacker can trigger an integer underflow. This results in an inflated remaining byte count during FTS5 MATCH query processing, leading to the overflow of attacker-controlled data into the heap. This vulnerability affects applications compiled with the SQLITE_ENABLE_FTS5 flag. To address this issue, users should upgrade SQLite to version 3.53.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11824.

In Milvus versions up to 2.6.13 a medium severity vulnerability CVE-2026-10814 was detected. This vulnerability may allow a local attacker to compromise the system through the exploitation of a weak cryptographic hash. This occurs because the Grantee ID Hash Handler component (specifically in internal/metastore/kv/rootcoord/kv_catalog.go) utilizes a weak hashing algorithm, which an attacker could potentially manipulate, despite the attack complexity being high. To address this issue, users should apply the recommended patch (commit 3d932f1c3e065351c4440c27abe1e6479752544d). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-10814.

In Weaviate versions up to 1.37.7 a medium severity vulnerability CVE-2026-11500 was detected. This vulnerability allows a remote attacker to bypass intended access controls and gain unauthorized access. This occurs due to improper validation of the StaticApiKey argument within the validateConfig function of the Static API Key Handler (internal/usecases/auth/authentication/apikey/client.go). Although the attack complexity is high and exploitability is considered difficult, a public exploit is available. To address this issue, users should apply the patch (commit 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0) or upgrade Weaviate to version 1.38.0-rc.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11500.

In Grafana versions 6.7.0 through 11.6.13, 12.0.0 through 12.2.7, 12.3.0 through 12.3.5, 12.4.0 through 12.4.2, 13.0.0 a medium severity vulnerability CVE-2026-28383 was detected. This vulnerability allows an authenticated attacker to cause a Denial of Service (DoS) by triggering an out-of-memory condition. This occurs because the Grafana plugin resources endpoint reads the entire request body into memory without size limits, leading to unbounded memory allocation. To address this issue, users should upgrade Grafana to version 11.6.14+security-04, 12.2.8+security-04, 12.3.6+security-04, 12.4.3+security-02, 13.0.1+security-01. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-283833.

In SQLite versions through 3.29.0 a medium severity vulnerability CVE-2019-16168 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing a browser or any other application using the database. This occurs due to a severe division by zero error in the query planner (specifically within the whereLoopAddBtreeIndex function in sqlite3.c), which is triggered by missing validation of the sqlite_stat1 sz field. To address this issue, users should upgrade SQLite to version 3.29.0 and later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2019-16168.

In MariaDB Server versions before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2 a medium severity vulnerability CVE-2026-35549 was detected. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the server. This occurs because when the caching_sha2_password authentication plugin is enabled and in use, sending a specially crafted large packet triggers a crash due to the unsafe use of the alloca function for memory allocation within sha256_crypt_r. To address this issue, users should upgrade MariaDB Server to versions 11.4.10, 11.8.6, or 12.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35549.

In pgAdmin 4 versions before 9.15 a high severity vulnerability CVE-2026-7816 was detected. This vulnerability allows an authenticated user to achieve arbitrary operating-system command execution on the pgAdmin server or perform arbitrary file writes. This occurs because user-supplied input (including the query, format, on_error, and log_verbosity fields) is interpolated directly into a psql \copy metacommand template without proper sanitization. An attacker can exploit this by injecting strings like “) TO PROGRAM ‘cmd'” to break out of the intended \copy (…) context. To address this issue, users should upgrade pgAdmin 4 to version 9.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7816.

In pgAdmin 4 versions prior to 9.15. a high severity vulnerability CVE-2026-7815 was detected. This vulnerability allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL on the connected PostgreSQL server, which can be escalated to operating-system command execution on the database host. This occurs because four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) are concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command without proper sanitization and passed to psql. To address this issue, users should upgrade pgAdmin 4 to version 9.15 or above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7815.