CVE-2026-10109

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
IBMDb2>= 11.5.0, <= 11.5.9; >= 12.1.0, <= 12.1.4

References

Timeline

Published
Jun 30, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1010909.8Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empCVE-2026-1010917.1SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers canCVE-2026-1010925.3SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve iCVE-2026-1010935.4Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups witCVE-2026-1010943.6The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parCVE-2026-1010984.3A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of CVE-2026-1010994.3A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the componenCVE-2026-10116.1A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sCVE-2026-101107.3A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of the file /index.phpCVE-2026-1011005.4A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the filCVE-2026-1011014.3A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/conveCVE-2026-1011026.3A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode San
CVE-2026-10109: Critical severity, CVSS 9.8 | Vulnix