NCSC-2026-0315

Vulnerability from csaf_ncscnl - Published: 2026-08-19 11:12 - Updated: 2026-08-19 11:12
Summary
Kwetsbaarheden verholpen in Oracle MySQL
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft kwetsbaarheden verholpen in Oracle MySQL Cluster en Oracle MySQL Connector/ODBC.
Interpretaties: Oracle MySQL Cluster versies 8.0.0 tot 8.0.48, 8.4.0 tot 8.4.11 en 9.7.0 tot 9.7.2 bevatten kwetsbaarheden die een niet-geauthenticeerde externe aanvaller via netwerktoegang toestaan denial of service te veroorzaken, ongeautoriseerde datamodificatie uit te voeren of het systeem over te nemen, waarbij sommig misbruik gebruikersinteractie vereisen. Oracle MySQL Connector/ODBC versie 26.7.0 bevat meerdere kwetsbaarheden die een niet-geauthenticeerde aanvaller met infrastructuurtoegang en soms gebruikersinteractie toestaan denial of service te veroorzaken door crashes, en in sommige gevallen ongeautoriseerde leestoegang tot data verkrijgen, wat de beschikbaarheid en vertrouwelijkheid beïnvloedt.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden in Oracle MySQL Cluster en Oracle MySQL Connector/ODBC te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-426: Untrusted Search Path
CWE-427: Uncontrolled Search Path Element
CWE-476: NULL Pointer Dereference
CWE-787: Out-of-bounds Write
CVE-2025-13151

A stack-based buffer overflow vulnerability (CVE-2025-13151) in libtasn1's asn1_expend_octet_string function allows remote attackers to cause Denial of Service (DoS) due to improper input size validation.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2025-14821

Libssh's insecure default Windows configuration allows local man-in-the-middle attacks via writable C:\etc configuration files, while Oracle Communications Cloud Native Core Binding Support Function 25.2.200 has a high-severity flaw enabling full compromise by low-privileged attackers.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-427 - Uncontrolled Search Path Element
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-0968

Multiple vulnerabilities in libssh up to version 0.11.3, including path traversal, denial of service via malformed SFTP messages, buffer underflow, and out-of-bounds reads, affect various NetApp products and Oracle Communications Cloud Native Core Binding Support Function.

3.1 (Low)
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-60592

A critical vulnerability in Oracle MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 allows unauthenticated remote attackers to cause denial of service or unauthorized data modification, with a CVSS 3.1 base score of 8.2.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-65914

A mutation-XSS vulnerability in DOMPurify versions before 3.3.2 allows attacker-controlled sequences to break out of special wrappers like script or xmp when sanitized HTML is reinserted via innerHTML, enabling JavaScript execution.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-70724

A vulnerability in Oracle MySQL Cluster versions 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2 allows unauthenticated remote attackers via HTTP to potentially take control, impacting confidentiality, integrity, and availability with a CVSS score of 7.5.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-71073

A vulnerability in Oracle MySQL Connector/ODBC 26.7.0 allows an unauthenticated attacker with infrastructure access and human interaction to cause denial-of-service by crashing or hanging the connector, with a CVSS 3.1 score of 5.5.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-71079

A denial of service vulnerability in Oracle MySQL Connectors (Connector/ODBC) version 26.7.0 allows a low-privileged attacker with network access to crash or hang the service, rated CVSS 3.1 base score 6.5.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
CVE-2026-71084

A vulnerability in Oracle MySQL Connector/ODBC 26.7.0 allows unauthenticated attackers with infrastructure access to cause denial of service and unauthorized read access, rated CVSS 3.1 base score 6.8.

6.8 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / MySQL
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Cluster
 vers:unknown/*
vers:unknown/*
Oracle / MySQL Connectors
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft kwetsbaarheden verholpen in Oracle MySQL Cluster en Oracle MySQL Connector/ODBC.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Oracle MySQL Cluster versies 8.0.0 tot 8.0.48, 8.4.0 tot 8.4.11 en 9.7.0 tot 9.7.2 bevatten kwetsbaarheden die een niet-geauthenticeerde externe aanvaller via netwerktoegang toestaan denial of service te veroorzaken, ongeautoriseerde datamodificatie uit te voeren of het systeem over te nemen, waarbij sommig misbruik gebruikersinteractie vereisen.\n\nOracle MySQL Connector/ODBC versie 26.7.0 bevat meerdere kwetsbaarheden die een niet-geauthenticeerde aanvaller met infrastructuurtoegang en soms gebruikersinteractie toestaan denial of service te veroorzaken door crashes, en in sommige gevallen ongeautoriseerde leestoegang tot data verkrijgen, wat de beschikbaarheid en vertrouwelijkheid be\u00efnvloedt.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden in Oracle MySQL Cluster en Oracle MySQL Connector/ODBC te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
        "title": "CWE-120"
      },
      {
        "category": "general",
        "text": "Untrusted Search Path",
        "title": "CWE-426"
      },
      {
        "category": "general",
        "text": "Uncontrolled Search Path Element",
        "title": "CWE-427"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle MySQL",
    "tracking": {
      "current_release_date": "2026-08-19T11:12:53.281086Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0315",
      "initial_release_date": "2026-08-19T11:12:53.281086Z",
      "revision_history": [
        {
          "date": "2026-08-19T11:12:53.281086Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "MySQL"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "MySQL Cluster"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "MySQL Connectors"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13151",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "A stack-based buffer overflow vulnerability (CVE-2025-13151) in libtasn1\u0027s asn1_expend_octet_string function allows remote attackers to cause Denial of Service (DoS) due to improper input size validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-13151 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-13151.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-13151"
    },
    {
      "cve": "CVE-2025-14821",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Search Path Element",
          "title": "CWE-427"
        },
        {
          "category": "description",
          "text": "Libssh\u0027s insecure default Windows configuration allows local man-in-the-middle attacks via writable C:\\etc configuration files, while Oracle Communications Cloud Native Core Binding Support Function 25.2.200 has a high-severity flaw enabling full compromise by low-privileged attackers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-14821 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14821.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2025-14821"
    },
    {
      "cve": "CVE-2026-0968",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in libssh up to version 0.11.3, including path traversal, denial of service via malformed SFTP messages, buffer underflow, and out-of-bounds reads, affect various NetApp products and Oracle Communications Cloud Native Core Binding Support Function.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0968 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0968.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-0968"
    },
    {
      "cve": "CVE-2026-60592",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 allows unauthenticated remote attackers to cause denial of service or unauthorized data modification, with a CVSS 3.1 base score of 8.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60592 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60592.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-60592"
    },
    {
      "cve": "CVE-2026-65914",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "A mutation-XSS vulnerability in DOMPurify versions before 3.3.2 allows attacker-controlled sequences to break out of special wrappers like script or xmp when sanitized HTML is reinserted via innerHTML, enabling JavaScript execution.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65914 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65914.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-65914"
    },
    {
      "cve": "CVE-2026-70724",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle MySQL Cluster versions 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2 allows unauthenticated remote attackers via HTTP to potentially take control, impacting confidentiality, integrity, and availability with a CVSS score of 7.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-70724 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70724.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-70724"
    },
    {
      "cve": "CVE-2026-71073",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle MySQL Connector/ODBC 26.7.0 allows an unauthenticated attacker with infrastructure access and human interaction to cause denial-of-service by crashing or hanging the connector, with a CVSS 3.1 score of 5.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-71073 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71073.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-71073"
    },
    {
      "cve": "CVE-2026-71079",
      "notes": [
        {
          "category": "description",
          "text": "A denial of service vulnerability in Oracle MySQL Connectors (Connector/ODBC) version 26.7.0 allows a low-privileged attacker with network access to crash or hang the service, rated CVSS 3.1 base score 6.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-71079 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71079.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-71079"
    },
    {
      "cve": "CVE-2026-71084",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle MySQL Connector/ODBC 26.7.0 allows unauthenticated attackers with infrastructure access to cause denial of service and unauthorized read access, rated CVSS 3.1 base score 6.8.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-71084 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71084.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3"
          ]
        }
      ],
      "title": "CVE-2026-71084"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.