Approved changes feed: RSS · Atom
cpe:2.3:a:taosdata:tdengine:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Taosdata (ab5d31e3-11e8-5d5a-ae44-3e450c695f59) |
|---|---|
| Product | Tdengine (6ccc00b1-74f9-50cf-9276-700150a34b6f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-62350 |
vulnerable | 2026-07-29 01:06:19.065836 |
TDengine: UDF lead to RCE
HIGH (7.2)
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15.
Published: 2026-07-15T18:54:26.320Z
Updated: 2026-07-18T01:18:49.611Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-62348 |
vulnerable | 2026-07-29 01:06:19.065582 |
TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations
MEDIUM (5.4)
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.
Published: 2026-07-15T19:07:07.692Z
Updated: 2026-07-16T19:12:45.290Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42542 |
vulnerable | 2026-07-29 00:49:32.043733 |
TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS)
HIGH (7.5)
TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.
Published: 2026-06-10T20:32:38.985Z
Updated: 2026-06-11T16:15:17.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38502 |
vulnerable | 2026-06-08 06:08:18.117403 |
TDengine Database Denial-of-Service
MEDIUM (6.5)
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query. This issue affects TDengine Databases which let users connect and run arbitrary queries. Version 3.0.7.1 has a patch for this issue.
Published: 2023-07-25T21:14:22.087Z
Updated: 2024-10-10T17:55:22.396Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.