These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in MariaDB Connector/Node.js allows for SQL injection when the session uses NO_BACKSLASH_ESCAPES. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. The vulnerability is caused by the text-protocol escaping always prefixing quotes with a backslash and not honoring the session's NO_BACKSLASH_ESCAPES mode. This issue can be exploited by an attacker-controlled placeholder value t [truncated]
MariaDB Connector/Node.js versions 3.2.0 through 3.2.5, 3.3.0 through 3.3.4, 3.4.0 through 3.4.7, and 3.5.0-rc.0 through 3.5.4 are vulnerable to SQL injection attacks when permitSetMultiParamEntries is enabled. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL, potentially leading to unauthorized data access or modi [truncated]
A vulnerability in MariaDB Connector/Node.js can cause an uncaught exception during ed25519 authentication with zero-configuration TLS, leading to a client crash. This issue arises from a reference error in the `Ed25519PasswordAuth.hash()` method. The vulnerability is triggered when the connector accepts a self-signed server certificate and attempts to validate the server's identity using a fingerprint hash.
CVE-2026-107383 is a high-severity vulnerability in MariaDB Connector/Node.js that exposes uninitialized process memory through malformed GeoJSON parameters. The vulnerability affects versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4. A malformed non-array ring can reserve bytes that the writing loop skips, disclosing uninitialized Node.js heap data into a database value. The persisted data can include oth [truncated]
CVE-2026-61700 is a vulnerability in MariaDB Connector/J that allows a rogue or man-in-the-middle server to echo a filename and cause the connector to transmit that file despite the disabled option allowLocalInfile=false. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The vulnerability affects applications that use MariaDB Connector/J and have allowLocalInfile set to false. Defenders sho [truncated]
CVE-2026-55860 debrief based on CVE Program and NVD records. The CVE record was published on 2026-08-28T23:17:09.153Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. This vulnerability affects MariaDB Connector/R2DBC versions prior to 1.4.1, allowing clear-text password authentication plugins to be used over unencrypted connections. A hostile or man-in-the-middle MariaD [truncated]
This debrief provides an analysis of CVE-2026-55858, a vulnerability in MariaDB Connector/J that could lead to silent data corruption due to a character encoding mismatch between the client and server. The vulnerability arises when the connector assumes a UTF-8 connection character set but does not properly handle changes to this setting during a session, potentially causing data corruption or loss. Defen [truncated]
CVE-2026-55857 debrief based on the supplied source corpus. The CVE record was published on 2026-08-28T23:17:08.680Z and has not been modified since then. This vulnerability affects MariaDB Connector/J, which is used to connect applications developed in Java to MariaDB and MySQL databases. The issue involves improper configuration of the PAM dialog authentication, allowing account passwords to be transmit [truncated]
A vulnerability in MariaDB Connector/J allows an active man-in-the-middle or hostile server to present a self-signed certificate and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The vulnerability arises when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not c [truncated]
CVE-2026-55855 MariaDB Connector/Node.js SQL Injection. The vulnerability allows attackers to inject SQL when using certain character sets. It affects versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Defenders should assess exposure and apply patches. The issue arises from improper escaping of Buffer parameters client-side, enabling SQL injection attacks. Successful exploitation can lead to data exposure [truncated]
CVE-2026-55854 MariaDB Connector/Node.js insecure transport vulnerability debrief. The vulnerability allows account password disclosure in MariaDB Connector/Node.js over insecure transport. Defenders responsible for Node.js applications using MariaDB Connector/Node.js, especially those with default sslMode=DISABLE and restrictedAuth=null settings, should assess exposure and prioritize verification and rem [truncated]
CVE-2026-55215 MariaDB Connector/Node.js Authentication Bypass. The vulnerability allows an active man-in-the-middle to capture database passwords and authenticate directly due to improper certificate validation and authentication plugin switching in MariaDB Connector/Node.js. Affected product deployments should be verified, and administrators should prioritize verification and remediation to prevent pote [truncated]
