products / mysql

MySQL

MySQL is Oracle's widely deployed open-source relational database. Attestd merges NVD data across two vendor namespaces: mysql:mysql (pre-Oracle acquisition) and oracle:mysql (current). Use dotted release versions (8.0.x, 8.4.x) as in NVD.

api usage

Querying MySQL

product slugmysql

version format8.0.32, 8.4.5

bash

curl "https://api.attestd.io/v1/check?product=mysql&version=8.0.32" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Version 8.0.32 is a spot-check for CVE-2023-21980 (RCE-class issue, CVSS 7.1). Replace the example JSON below with the live API response after ingestion on your environment.

json

{
  "product": "mysql",
  "version": "8.0.32",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-21972",
    "CVE-2023-21976",
    "CVE-2023-21977",
    "CVE-2023-21980",
    "CVE-2023-21982",
    "CVE-2023-22007",
    "CVE-2023-22032",
    "CVE-2023-22059",
    "CVE-2023-22064",
    "CVE-2023-22065",
    "CVE-2023-22066",
    "CVE-2023-22068",
    "CVE-2023-22070",
    "CVE-2023-22078",
    "CVE-2023-22079",
    "CVE-2023-22084",
    "CVE-2023-22092",
    "CVE-2023-22097",
    "CVE-2023-22103",
    "CVE-2023-22104",
    "CVE-2023-22110",
    "CVE-2023-22111",
    "CVE-2023-22112",
    "CVE-2023-22113",
    "CVE-2023-22114",
    "CVE-2023-22115",
    "CVE-2024-20961",
    "CVE-2024-20963",
    "CVE-2024-20965",
    "CVE-2024-20967",
    "CVE-2024-20969",
    "CVE-2024-20971",
    "CVE-2024-20973",
    "CVE-2024-20977",
    "CVE-2024-20981",
    "CVE-2024-20983",
    "CVE-2024-20985",
    "CVE-2024-20996",
    "CVE-2024-21047",
    "CVE-2024-21049",
    "CVE-2024-21050",
    "CVE-2024-21051",
    "CVE-2024-21055",
    "CVE-2024-21056",
    "CVE-2024-21061",
    "CVE-2024-21062",
    "CVE-2024-21069",
    "CVE-2024-21087",
    "CVE-2024-21096",
    "CVE-2024-21101",
    "CVE-2024-21102",
    "CVE-2024-21125",
    "CVE-2024-21127",
    "CVE-2024-21129",
    "CVE-2024-21130",
    "CVE-2024-21134",
    "CVE-2024-21135",
    "CVE-2024-21137",
    "CVE-2024-21142",
    "CVE-2024-21157",
    "CVE-2024-21159",
    "CVE-2024-21160",
    "CVE-2024-21162",
    "CVE-2024-21163",
    "CVE-2024-21165",
    "CVE-2024-21166",
    "CVE-2024-21171",
    "CVE-2024-21173",
    "CVE-2024-21193",
    "CVE-2024-21194",
    "CVE-2024-21196",
    "CVE-2024-21197",
    "CVE-2024-21198",
    "CVE-2024-21199",
    "CVE-2024-21200",
    "CVE-2024-21201",
    "CVE-2024-21203",
    "CVE-2024-21207",
    "CVE-2024-21212",
    "CVE-2024-21213",
    "CVE-2024-21218",
    "CVE-2024-21219",
    "CVE-2024-21230",
    "CVE-2024-21231",
    "CVE-2024-21236",
    "CVE-2024-21237",
    "CVE-2024-21238",
    "CVE-2024-21239",
    "CVE-2024-21241",
    "CVE-2024-21247",
    "CVE-2025-50076",
    "CVE-2025-50077",
    "CVE-2025-50078",
    "CVE-2025-50079",
    "CVE-2025-50080",
    "CVE-2025-50081",
    "CVE-2025-50082",
    "CVE-2025-50083",
    "CVE-2025-50084",
    "CVE-2025-50085",
    "CVE-2025-50086",
    "CVE-2025-50087",
    "CVE-2025-50088",
    "CVE-2025-50091",
    "CVE-2025-50092",
    "CVE-2025-50093",
    "CVE-2025-50096",
    "CVE-2025-50097",
    "CVE-2025-50098",
    "CVE-2025-50099",
    "CVE-2025-50100",
    "CVE-2025-50101",
    "CVE-2025-50102",
    "CVE-2025-50104",
    "CVE-2026-21964",
    "CVE-2026-34317",
    "CVE-2026-34318",
    "CVE-2026-34319",
    "CVE-2026-39931",
    "CVE-2026-60171",
    "CVE-2026-60569"
  ],
  "cves": null,
  "max_epss": 0.01782,
  "last_updated": "2026-08-16T11:18:08.825063Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

cleaner line

Example: newer release

A current GA line (e.g. 9.x) may return risk_state: "none" if no NVD ranges match. Verify with /v1/check after synthesis.

bash

curl "https://api.attestd.io/v1/check?product=mysql&version=9.2.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

CVE	Description	Affects	CVSS
`CVE-2023-21980`	Vulnerability in MySQL Server allowing high-privilege attackers with network access to compromise the server.	8.0.x (see NVD)	7.1
`CVE-2022-21589`	MySQL Server vulnerability. Component InnoDB; authenticated network attacker.	8.0, 8.1	4.9
`CVE-2021-3711`	OpenSSL-related exposure in bundled components (context-dependent).	see NVD	7.5
`CVE-2020-14878`	MySQL Server privilege escalation / unauthorized data access vectors.	8.0	4.9
`CVE-2018-3282`	InnoDB component flaw allowing denial of service.	5.7, 8.0	6.5

data sources

CPE namespaces

Ingestion queries both cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* and cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*, then deduplicates on CVE ID. Skipping either namespace can miss historical CVE rows.

All products MariaDB PostgreSQL