CVE-2026-86047: SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL
- Severity
- 7.7 (HIGH)
- Affected versions
- 10
- Patch status
- Unknown
- Published
- 2026-10-16T17:17:52.063
- Modified
- 2026-10-16T18:09:12.750
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
Technical summary
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
View the official NVD record for CVE-2026-86047
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
327 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-95182 |
An untrusted search path in DeepSeek Harness (dsh) commit c291e796
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-85746 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85748 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-92262 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-49868 |
RIOT PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-111823 |
Mage OSS PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104736 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-18516 |
Crafty Controller
Reporter: CVE
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-102693 |
RIOT PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-57169 |
dockhand PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-107617 |
EseeCloud App
Reporter: ICS-CERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-105279 |
dcm4chee-arc-light PATCH
Reporter: ICS-CERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109587 |
FreeRTOS-Kernel PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109588 |
FreeRTOS-Kernel PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111626 |
Damselfly
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111641 |
FastapiAdmin
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111643 |
misaka_danmu_server
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111673 |
IceCMS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111687 |
we-mp-rss
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111690 |
Simple Admin Core
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111692 |
databuff
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111693 |
databuff
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111704 |
langchat
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111708 |
whaticket-community
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111711 |
Netcore NR256CN
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111391 |
SGLang 0.5.10
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102551 |
FreeRTOS-Plus-TCP PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111636 |
OpenBMB StaffDeck
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111663 |
Chaskiq
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-96620 |
claude-agent-sdk-python PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102692 |
RIOT PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111675 |
course-tencent-cloud
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111691 |
wimoor
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-110653 |
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-44977 |
countly-server PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-102608 |
zoneminder PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-111413 |
aThemeArt aThemeArt Theme Helper athemeart-theme-helper
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-106705 |
ELADMIN (eladmin-mp) up to 2.7
Reporter: CVE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-97851 |
The storage status-change REST service
Reporter: ICS-CERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-97380 |
server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111633 |
ZKEACMS
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111650 |
ChronoFrame
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102607 |
ZoneMinder is a free, open source closed-circuit television software application PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-30971 |
ZoneMinder is a free, open source closed-circuit television software application PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-96627 |
Arcane is an interface for managing Docker containers, images, networks, and volumes PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111853 |
An issue was discovered on Tektronix 3 Series MDO devices PATCH
Reporter: CVE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-107564 |
VDE
Reporter: INFO
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-101021 |
DHS
Reporter: ICS-CERT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105273 |
DHS
Reporter: ICS-CERT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105667 |
DHS
Reporter: ICS-CERT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-107621 |
DHS
Reporter: ICS-CERT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-68906 |
src/mms/iso acse/acse.c checks len for zero PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-95859 |
libp2p-rust is the official Rust language implementation of the libp2p networking stack PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111612 |
netdisk-fast-download
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111613 |
AllData
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111642 |
FastapiAdmin
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111681 |
EFAK
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111685 |
IceCMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111686 |
IceCMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111702 |
chat-ollama
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111706 |
Product identification pending
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111710 |
Netcore NR256CN
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111723 |
LingGuo-Drama
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111605 |
Jpom
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111606 |
Huly Platform
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111627 |
HestiaCP PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111634 |
Helical Insight
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111639 |
bbs-go
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111722 |
LingGuo-Drama
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-111399 |
PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-55543 |
TuxGuitar is an open-source guitar tablature editor PATCH
Reporter: SECURITY-ADVISORIES
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-96626 |
Arcane is an interface for managing Docker containers, images, networks, and volumes PATCH
Reporter: SECURITY-ADVISORIES
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-111638 |
sshportal
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-111701 |
OtterMind Nubase
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-68907 |
libiec61850 PATCH
Reporter: SECURITY-ADVISORIES
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-86009 |
Mailu
Reporter: SECURITY-ADVISORIES
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-102552 |
FreeRTOS-Plus-TCP PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-111646 |
SurveyKing PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-111719 |
roncoo-pay
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-42269 |
countly-server is the server-side part of Countly, a product analytics solution PATCH
Reporter: SECURITY-ADVISORIES
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-61726 |
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists PATCH
Reporter: SECURITY-ADVISORIES
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-49410 |
OpenHuman is an open-source agent harness available as a desktop application and Rust library PATCH
Reporter: SECURITY-ADVISORIES
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111854 |
An issue was discovered on Tektronix 3 Series MDO devices PATCH
Reporter: CVE
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-92798 |
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Reporter: SECURITY
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-88755 |
Product identification pending
Reporter: CVE
|
7.8
HIGH
|
VIEW RECORD |
| CVE-2026-96424 |
lomiri-download-manager
Reporter: CVE
|
7.8
HIGH
|
VIEW RECORD |
| CVE-2026-102917 |
IBM i 7.3, 7.4, 7.5, and 7.6
Reporter: PSIRT
|
7.8
HIGH
|
VIEW RECORD |
| CVE-2026-86047 |
SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL PATCH
Reporter: SECURITY-ADVISORIES
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-59970 |
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists PATCH
Reporter: SECURITY-ADVISORIES
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-108374 |
ERPNext is a free and open source Enterprise Resource Planning tool PATCH
Reporter: SECURITY-ADVISORIES
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-111622 |
smart-sso
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-111044 |
Sunshine PATCH
Reporter: SECURITY-ADVISORIES
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-105959 |
REDHAT
Reporter: SECALERT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-105958 |
REDHAT
Reporter: SECALERT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-63618 |
Apache Kylin: from 4 PATCH
Reporter: SECURITY
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-102941 |
parser/parser.go slices url[:nPath] PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-41582 |
countly-server is the server-side part of Countly, a product analytics solution PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-42270 |
countly-server is the server-side part of Countly, a product analytics solution PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-46472 |
An issue was discovered in GStreamer gst-plugins-good PATCH
Reporter: CVE
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-48503 |
libiec61850 PATCH
Reporter: SECURITY-ADVISORIES
|
7.5
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.