MariaDB Connector/J Vulnerability (CVE-2026-119276)

Life Of This Page

1. 1
   Born
   Oct 30 23:00 UTC
   A second, independent source names it.
2. 2
   Developing · Now
   Oct 30 23:00 UTC
   New signals join; severity can move.
3. 3
   Confirmed
   Not yet
   CISA KEV lists it, or exploitation in the wild is reported.
4. 4
   Resolved
   Not yet
   Past the fix deadline and 14 days with no new signal.
5. 5
   Archived
   Not yet
   30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

1. Disclosed: reached
   Oct 29 20:47 UTC
   C41 first to name it
2. Scored: reached
   Oct 29 20:47 UTC
   No CVSS yet · EPSS 0.4%
3. Exploited: not yet
   Not yet
   No exploitation reported
4. Advisories: not yet
   Not yet
   None yet
5. Vendor Response: reached
   Oct 29 20:47 UTC
   C41 published
6. Resolved: not yet
   Not yet
   After 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.