High WID-SEC-2026-2903 9 CVEs

Oracle MySQL: Mehrere Schwachstellen

Published Aug 18, 2026 · Updated Aug 18, 2026 · de-DE

Vendor: Oracle Product: MySQL Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

MySQL ist ein Open Source Datenbankserver von Oracle.

Vulnerabilities 9

High 8.2

CVE-2026-60592

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). Supported versions that …

Oracle MySQL Cluster

Aug 18, 2026
High 7.8

CVE-2025-14821

Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availa…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Wolfi

Apr 7, 2026
High 7.5

CVE-2025-13151

CVE-2025-13151

Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.

gnutls libtasn1 gnutls libtasn1-6 Debian Ubuntu Azure Linux Alpine

Jan 7, 2026
High 7.5

CVE-2026-70724

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…

Oracle MySQL Cluster

Aug 18, 2026
Medium 6.8

CVE-2026-71084

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that i…

Oracle MySQL Connectors mysql-connector-java Ubuntu

Aug 18, 2026
Medium 6.5

CVE-2026-71079

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that i…

Oracle MySQL Connectors mysql-connector-java Ubuntu

Aug 18, 2026
Medium 5.5

CVE-2026-71073

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). The supported version that i…

Oracle MySQL Connectors mysql-connector-java Ubuntu

Aug 18, 2026
Medium 5.3

CVE-2026-65914

DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequ…

cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm

Jul 23, 2026
Low 3.1

CVE-2026-0968

Libssh: libssh: denial of service due to malformed sftp message

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading bey…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Mar 26, 2026

Revision history

2026-08-18 #1
Initiale Fassung

References

Oracle Critical Security Patch Update Advisory - August 2026 - Appendix Oracle MySQL vom 2026-08-18
https://www.oracle.com/security-alerts/cspuaug2026.html#AppendixMSQL