Taosdata vulnerabilities
We track 5 vulnerabilities in Taosdata products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2026.
Latest Taosdata vulnerabilities
- 7.5 High severity
TDengine: Out-of-bounds Read
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contained t
- 7.2 High severity
TDengine: Improper Control of Generation of Code
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary
- 8.3 High severity
TDengine: Stack-based Buffer Overflow
TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowin
- 7.5 High severity
TDengine: Integer Underflow (Wrap or Wraparound)
TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prio
- 9.8 Critical severity
grafanaplugin: Improper Neutralization of Special Elements used in a Command
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.ti