Advisories · Technology

IBM Db2.

Every CVE that names IBM Db2 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-104364 CVE record

CVSS 3.3 Low

IBM® Db2® Denial of Service
- IBM Db2
- CWE-20
Not analysed yet 12 Oct 2026
CVE-2026-104332 CVE record

CVSS 5.5 Medium

IBM® Db2® Denial of Service
- IBM Db2
- Memory corruption
Not analysed yet 12 Oct 2026
CVE-2026-18166 CVE record

CVSS 7.7 High

IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem
- IBM Db2
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-105464 CVE record

CVSS 8.8 High

IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management
- IBM Db2
- Privilege escalation
Not analysed yet 12 Oct 2026
CVE-2026-105466 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions
- IBM Db2
- Denial of service
Not analysed yet 12 Oct 2026
CVE-2026-105465 CVE record

CVSS 8.8 High

IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance
- IBM Db2
- Privilege escalation
Not analysed yet 12 Oct 2026
CVE-2026-78404 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility
- IBM Db2
- Privilege escalation
Not analysed yet 12 Oct 2026
CVE-2026-15955 CVE record

CVSS 7.5 High

IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths
- IBM Db2
- Path traversal
Not analysed yet 14 Sept 2026
CVE-2026-16702 CVE record

CVSS 6.5 Medium

IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference
- IBM Db2
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-17463 CVE record

CVSS 6.5 Medium

IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption
- IBM Db2
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-86087 CVE record

CVSS 4.3 Medium

IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system
- IBM Db2
- Path traversal
Not analysed yet 10 Sept 2026
CVE-2026-86093 CVE record

CVSS 7.5 High

IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions
- IBM Db2
- Memory corruption
Not analysed yet 10 Sept 2026
CVE-2026-87958 CVE record

CVSS 8.1 High

IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions
- IBM Db2
- Privilege escalation
Not analysed yet 10 Sept 2026
CVE-2026-10534 CVE record

CVSS 8.4 High

IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser
- IBM Db2
- Memory corruption
Not analysed yet 12 Aug 2026
CVE-2026-10543 CVE record

CVSS 8.2 High

IBM® Db2® is vulnerable to privilege escalation with a specially crafted query
- IBM Db2
- Broken access control
Not analysed yet 12 Aug 2026
CVE-2026-16480 CVE record

CVSS 4.3 Medium

IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
- IBM Db2
- CWE-602
Not analysed yet 12 Aug 2026
CVE-2026-18097 CVE record

CVSS 5.5 Medium

IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.
- IBM Db2
- Information disclosure
Not analysed yet 12 Aug 2026
CVE-2026-18096 CVE record

CVSS 3.3 Low

IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak
- IBM Db2
- Denial of service
Not analysed yet 12 Aug 2026
CVE-2026-10535 CVE record

CVSS 8.4 High

IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell
- IBM Db2
- Memory corruption
Not analysed yet 30 Jul 2026
CVE-2026-10695 CVE record

CVSS 6.2 Medium

IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries
- IBM Db2
- Denial of service
Not analysed yet 30 Jul 2026
CVE-2026-7771 CVE record

CVSS 5.5 Medium

IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service
- IBM Db2
- Denial of service
Not analysed yet 17 Jul 2026
CVE-2026-9762 CVE record

CVSS 7.8 High

IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
- IBM Db2
- Code injection
Not analysed yet 17 Jul 2026
CVE-2025-36372 CVE record

CVSS 5.5 Medium

IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables
- IBM Db2
- Information disclosure
Not analysed yet 30 Jun 2026
CVE-2026-10109 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling
- IBM Db2
- Code injection
Not analysed yet 30 Jun 2026
CVE-2026-11906 CVE record

CVSS 6.5 Medium

IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user
- IBM Db2
- CWE-1284
Not analysed yet 30 Jun 2026
CVE-2026-6938 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query
- IBM Db2
- Broken access control
Not analysed yet 27 May 2026
CVE-2026-6053 CVE record

CVSS 5.5 Medium

IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables
- IBM Db2
- Denial of service
Not analysed yet 27 May 2026
CVE-2026-6052 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables
- IBM Db2
- Denial of service
Not analysed yet 27 May 2026
CVE-2026-6051 CVE record

CVSS 5.5 Medium

IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap
- IBM Db2
- Denial of service
Not analysed yet 27 May 2026
CVE-2026-1718 CVE record

CVSS 7.1 High

IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure
- IBM Db2
- Denial of service
Not analysed yet 27 May 2026
CVE-2025-13755 CVE record

CVSS 5.5 Medium

IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets
- IBM Db2
- Information disclosure
Not analysed yet 26 May 2026
CVE-2026-1577 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries
- IBM Db2
- CWE-20
Not analysed yet 30 Apr 2026
CVE-2025-36122 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic
- IBM Db2
- Denial of service
Not analysed yet 30 Apr 2026
CVE-2025-14688 CVE record

CVSS 5.3 Medium

IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations
- IBM Db2
- CWE-1284
Not analysed yet 30 Apr 2026
CVE-2026-1352 CVE record

CVSS 6.5 Medium

IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index
- IBM Db2
- CWE-1284
Not analysed yet 22 Apr 2026
CVE-2025-36006 CVE record

CVSS 6.5 Medium

IBM Db2 denial of service
- IBM Db2
- Denial of service
Not analysed yet 7 Nov 2025
CVE-2025-36008 CVE record

CVSS 6.5 Medium

IBM Db2 denial of service
- IBM Db2
- Denial of service
Not analysed yet 7 Nov 2025
CVE-2025-36131 CVE record

CVSS 4.6 Medium

IBM Db2 information disclosure
- IBM Db2
- Information disclosure
Not analysed yet 7 Nov 2025
CVE-2025-36136 CVE record

CVSS 5.1 Medium

IBM denial of service
- IBM Db2
- Denial of service
Not analysed yet 7 Nov 2025
CVE-2025-36185 CVE record

CVSS 6.2 Medium

IBM Db2 denial of service
- IBM Db2
- Other injection
Not analysed yet 7 Nov 2025
CVE-2025-36186 CVE record

CVSS 7.4 High

IBM Db2 privilege escalation
- IBM Db2
- Privilege escalation
Not analysed yet 7 Nov 2025
CVE-2025-33012 CVE record

CVSS 6.3 Medium

IBM Db2 improper account lockout
- IBM Db2
- CWE-324
Not analysed yet 7 Nov 2025
CVE-2025-2534 CVE record

CVSS 5.3 Medium

IBM Db2 denial of service
- IBM Db2
- Denial of service
Not analysed yet 7 Nov 2025
CVE-2024-47118 CVE record

CVSS 6.5 Medium

IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query
- IBM Db2
- Memory corruption
Not analysed yet 7 Nov 2025
CVE-2024-49828 CVE record

CVSS 6.5 Medium

IBM Db2 for Linux, UNIX and Windows denial of service
- IBM Db2
- Memory corruption
Not analysed yet 29 Jul 2025
CVE-2024-51473 CVE record

CVSS 6.5 Medium

IBM Db2 for Linux, UNIX and Windows denial of service
- IBM Db2
- Memory corruption
Not analysed yet 29 Jul 2025
CVE-2024-52894 CVE record

CVSS 4.9 Medium

IBM Db2 for Linux, UNIX and Windows denial of service
- IBM Db2
- Memory corruption
Not analysed yet 29 Jul 2025
CVE-2025-33114 CVE record

CVSS 5.3 Medium

IBM Db2 for Linux denial of service
- IBM Db2
- Other injection
Not analysed yet 29 Jul 2025
CVE-2025-33092 CVE record

CVSS 7.8 High

IBM Db2 for Linux code execution
- IBM Db2
- Memory corruption
Not analysed yet 29 Jul 2025
CVE-2025-36071 CVE record

CVSS 6.5 Medium

IBM Db2 denial of service
- IBM Db2
- Denial of service
Not analysed yet 29 Jul 2025
CVE-2025-36010 CVE record

CVSS 6.5 Medium

IBM Db2 for Linux denial of service
- IBM Db2
- Denial of service
Not analysed yet 29 Jul 2025
CVE-2025-2533 CVE record

CVSS 5.3 Medium

IBM Db2 for Linux denial of service
- IBM Db2
- Denial of service
Not analysed yet 29 Jul 2025
CVE-2024-40679 CVE record

CVSS 5.5 Medium

IBM Db2 information disclosure
- IBM Db2
- Information disclosure
Not analysed yet 8 Jan 2025
CVE-2023-47145 CVE record

CVSS 8.4 High

IBM Db2 for Windows privilege escalation
- IBM Db2
- Privilege escalation
Not analysed yet 7 Jan 2024
CVE-2019-4014 CVE record

CVSS 8.4 High

IBM DB2: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5…
- IBM DB2
Not analysed yet 3 Apr 2019
CVE-2018-1936 CVE record

CVSS 8.4 High

IBM DB2: IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer…
- IBM DB2
Not analysed yet 3 Apr 2019