CVE-2026-108536

MediumCVSS 4.6/10Last modified Nov 12, 2026

Description

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
IBM	Db2 Genius Hub	1.1.2; 1.1.3; 1.1.4; 1.1.5

References

https://www.ibm.com/support/pages/node/7295187Vendor Advisory

Timeline

Published: Nov 4, 2026
Last modified: Nov 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1085386.3A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c CVE-2026-1085396.3A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the compon CVE-2026-108544.3A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to othe CVE-2026-1085409.9A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File CVE-2026-1085416.3A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstoref CVE-2026-1085426.3A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/in CVE-2026-1085436.3A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgen CVE-2026-1085446.3A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxview CVE-2026-1085455.9SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resour CVE-2026-1085467.5Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute c CVE-2026-1085476.5AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants CVE-2026-1085487.3AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer