These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
TDengine, an open-source time-series database, had an issue where a Data Reader admin_user on a TDengine Cloud DB instance could run create udf despite having read-only permissions for non-database objects. This was fixed in version 3.4.1.15. The issue allows potential unauthorized creation of user-defined functions and possible elevation of privileges for Data Reader admin_user roles. Defenders managing [truncated]
TDengine, a time-series database for IoT devices, had an issue in versions prior to 3.4.1.14 where an authenticated user could submit a SQL query that would cause the server to crash and potentially leak memory due to improper handling of SQL string literals. This issue is fixed in version 3.4.1.14. The vulnerability allows an authenticated user to crash the server and potentially leak adjacent memory by [truncated]
TDengine, a time-series database for IoT devices, had an issue in versions prior to 3.4.1.15. In the `transDecompressMsg()` function, located in `source/libs/transport/src/transComm.c`, an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash could occur. This happened because the function read `STransCompMsg.contLen` when `pHead->comp == 1` without validating th [truncated]
A high-severity vulnerability was found in TDengine, a time-series database optimized for Internet of Things devices. The issue allows a user with create udf privilege to upload a crafted shared library and install it as a user-defined function, enabling execution of arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15. The vulnerability could allo [truncated]
TDengine, an open-source time-series database, has a vulnerability in versions 3.4.1.6 and earlier. The issue lies in the `trimString()` function, which can lead to a one-byte out-of-bounds write to the stack buffer `tmpTokenBuf`. This can cause denial of service and potentially remote code execution. The vulnerability is fixed in version 3.4.1.14.
CVE-2026-62348 is a medium-severity vulnerability in TDengine Enterprise, allowing an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration. This issue is fixed in version 3.4.1.15. The vulnerability has a CVSS score of 5.4 and is classified as MEDIUM. The CVE record was published on 2026-07-15T19:18:37.107Z and has not been modified since then.
CVE-2026-42542 is a HIGH severity vulnerability in TDengine, an open source time-series database optimized for Internet of Things devices. Versions 3.4.0.0 through 3.4.1.5 are vulnerable. An unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. The issue is fixed in version 3.4.1.6.