MySQL Server vulnerabilities

21 known vulnerabilities in MySQL Server from Oracle. 21 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101797Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and

• 7.5 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101796Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 a

• 7.2 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101786Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged

• 8.3 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101785Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7

• 8.8 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101781Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7

• 7.4 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101775Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 a

• 7.1 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101773Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12,

• 8.1 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101772Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 2

• 8.1 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101771Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 2

• 8.1 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101770Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 2

• 7.5 High severity

  MySQL Server: Improper Access Control

  CVE-2026-101679Oct 20, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 2

• 7.2 High severity

  MySQL Server: Improper Privilege Management

  CVE-2026-61094Jul 21, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily explo

• 7.2 High severity

  MySQL Server: Improper Access Control

  CVE-2026-60316Jul 21, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploita

• 8.2 High severity

  MySQL Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-60315Jul 21, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploita

• 8.4 High severity

  MySQL Server: Improper Access Control

  CVE-2026-60163Jul 21, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1.

• 7.5 High severity

  MySQL Server: Uncontrolled Resource Consumption

  CVE-2026-46863Jun 17, 2026Oracle

  Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easil

• 7.5 High severity

  MySQL Server: Allocation of Resources Without Limits or Throttling

  CVE-2025-21521Jan 21, 2025OracleEPSS 1.1%

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows unauthenticated attacker with

• 7.1 High severity

  MySQL Server: Improper Access Control

  CVE-2023-21980Apr 18, 2023Oracle

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via mu

• 8.1 High severity

  https://github.com/curl/curl: Use of Incorrectly-Resolved Name or Reference

  CVE-2022-27778Jun 2, 2022Https://github.com/curl/curlEPSS 3.81%

  A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

• 7.3 High severity

  OpenSSL: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-1292May 3, 2022OpenSSLEPSS 82.6%

  The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrar

• 8.2 High severity

  Node: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2022-21824Feb 24, 2022Node.jsEPSS 21.5%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could b