Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-94169 (CVSS: 10) Theme-one CVE-2026-95182 (CVSS: 10) CVE-2026-85746 (CVSS: 9.9) MariaDB CVE-2026-85748 (CVSS: 9.9) MariaDB CVE-2026-92262 (CVSS: 9.9) MariaDB ..🧵👇
├ CVE-2026-85748 · MariaDB · Use-after-free with many SYS_REFCURSORs (9.9) └ CVE-2026-92262 · MariaDB · Issues from legacy #mysql50# table name encoding (9.9)
[CVE] CVE-2026-85748 [HIGH PRIORITY] CVSS: 9.9 | Vendor: #MariaDB #MariaDB: Use-after-free with a large number of SYS_REFCURSOR's 🔗 https://exploitgrid.net/cve/CVE-2026-85748
NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 17 Oct 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🚨 Remote-support appliance matched to an actively-exploited spoofing bug — file operations on the appliance itself (BeyondTrust CVE-2026-102764) 📦 Database version read off the connection handshake — the server names its own build before anyone authenticates (MariaDB CVE-2026-85746, CVE-2026-85748, CVE-2026-97380) 📦 Vulnerable WordPress plugin builds — object injection at checkout, a raced OTP lockout, customer records read by anyone (LearnPress CVE-2026-104736, LatePoint CVE-2026-110653, CVE-2026-111602, ThirstyAffiliates CVE-2026-97314, aThemeArt CVE-2026-111413) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #AuthBypass #CSO #REDTEAM