- AI Assistant:
- Added drag-and-drop support for Navigator objects and files in AI Chat
- Added support for attaching images to AI Chat from files, drag-and-drop, and the clipboard
- Fixed an issue where closing multiple SQL Editor tabs cleared the selected AI Chat connection and conversation
- Fixed SQL block Execute, Copy, and Open in editor actions on Linux (thanks to @Josephur)
- Fixed small font sizes and unnecessary truncation for profile and model names in AI Chat
- ChatGPT subscription errors are now displayed as readable messages instead of raw JSON
- SQL Editor:
- Added the ability to execute SQL script files without opening them in the SQL Editor
- Added a notification for refreshing affected metadata after successful DDL execution
- Fixed an issue where new SQL templates used Vertica instead of abstract SQL as the default context
- Fixed SQL Editor corruption when deleting an auto-inserted closing bracket in Eclipse installations with TM4E (thanks to @RoiSoleil)
- Metadata Editor:
- Fixed checkbox backgrounds in the table column dialog on macOS in dark mode
- Data Editor:
- Fixed Adaptive Ordering for large numeric values
- Fixed row order when dragging multiple selected result-set rows into the SQL Editor (thanks to @Abdulrahman295)
- Data transfer:
- Redesigned the extraction settings page
- Redesigned the export target page with in-wizard source management
- Connectivity:
- Improved error messages for invalid SSH known-hosts files with the affected file path and corrective guidance
- Fixed empty credential dialogs for integrated authentication methods
- Fixed an issue where connection settings could be cut off and could not be scrolled after changing authentication options
- Security:
- Fixed a command execution vulnerability by requiring confirmation before running shell commands used to retrieve connection passwords (CWE-78, CWE-306)
- Fixed high, medium, and low vulnerabilities in the lz4-java library used by the ClickHouse and Databricks drivers (CVE-2026-106451, CVE-2026-106450, and CVE-2026-106449). The library was updated to version 1.11.4.
- Product configuration:
- Git integration is now enabled by default when existing Git projects are detected
- The SQLite sample database is now enabled by default
- New drivers:
- Added support for YashanDB (thanks to @YoungQinger9)
- Databases:
- Clickhouse: Added the ability to rename tables from the Navigator tree.
- CUBRID: Fixed extra quoting around hexadecimal default values in generated DDL (thanks to @longhaseng52)
- MySQL: Restored bold highlighting for catalogs and tables with granted privileges
- Oracle: User profiles now show their assigned users
- PostgreSQL:
- Fixed bulk imports that mishandled literal backslashes or custom CSV escape characters
- Fixed SQL formatting for the @? operator (thanks to @SemTiOne)
- SQL Server:
- Fixed missing quotes around datetimeoffset values when copying multiple cells or rows as SQL
- Non-online databases are now marked in Navigator, and their status is shown in the Databases tab (thanks to @michalpsyk)
- Localization:
- Added Traditional Chinese (Taiwan) localization
Intelligence View
⚡ tsecurity.de Intelligence
GitHub Release: dbeaver/dbeaver v26.2.3 (18.10.2026)
Release 26.2.3 von dbeaver/dbeaver auf GitHub: - AI Assistant: - Added drag-and-drop support for Navigator objects and files in AI Chat - Added support for…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Compliance, SLA & Vendor Adherence
Advisory-Prüfung · Score-Einordnung · Fristen
CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Impact: 1.41 | Exploitability: 3.89
AVN
Netzwerk (Remote)
Aus der Ferne über das Internet ohne Vorbedingungen exploitbar.
ACL
Niedrig (Low)
Wiederholbar und deterministisch ohne spezielle Race Conditions ausnutzbar.
PRN
Keine (Unauthenticated)
Vollständig unauthentifiziert ohne Benutzerkonto exploitbar.
UIN
Keine (Zero-Click)
Autonom ohne menschliches Zutun ausführbar (Zero-Click Exploitation).
SU
Unverändert (Scope Unchanged)
Auswirkungen verbleiben isoliert in der angreifbaren Anwendungskomponente.
CN
Keine
Teilweiser oder kein Datenabfluss.
IN
Keine
Teilweise oder keine Manipulation.
AL
Gering (Drosselung)
Teilweise oder keine Beeinträchtigung.
NVD Primärbewertung & CISA SSVCCVE-2026-106450
NVD: Awaiting AnalysisNVD 5.3 · MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD-Datenstand: 09.10.2026, 02:16 UTC
Ausnutzung beobachtet: Nein Automatisierbar: Ja Technischer Impact: Teilweise
BSI-Warnung (Deutschland)CVE-2026-106451
DBeaver: Mehrere Schwachstellen hoch18.10.2026CISA-SSVC-Triage (vulnrichment)CVE-2026-106451
Exploitation: none (Keine bekannte Ausnutzung)Automatable: no (Nicht automatisierbar)Technical Impact: total (Vollständig)
Quelle: CISA-ADP vulnrichment · Stand 2026-10-07T18:25:34.130789Z · CISA Coordinator
Advisory Radar
In herstellerseitiger Prüfung
Hersteller-Sicherheitsmeldungen & Patch-Status
Handlungsempfehlung für Administratoren
Hersteller-Advisory noch nicht formal hinterlegt. Regelmäßiges Re-Scanning der CTI-Quellen anberaumt.
Referenzen aus der Primärquelle („Verifiziert" nur bei Hersteller-Domäne):
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
-
Upstream-Referenz (Code-Hosting, kein Advisory)github.com
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar