IBM Db2
55 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-104364 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® Denial of Service | LOW 3.3 | 0.1 % | ||
| CVE-2026-104332 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® Denial of Service | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-18166 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitiv… | HIGH 7.7 | 0.2 % | ||
| CVE-2026-105464 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management | HIGH 8.8 | 0.1 % | ||
| CVE-2026-105466 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-105465 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance | HIGH 8.8 | 0.1 % | ||
| CVE-2026-78404 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-15955 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of … | HIGH 7.5 | 0.5 % | ||
| CVE-2026-16702 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-17463 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-86087 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-86093 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary… | HIGH 7.5 | 0.4 % | ||
| CVE-2026-87958 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under … | HIGH 8.1 | 0.4 % | ||
| CVE-2026-10534 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-10543 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is vulnerable to privilege escalation with a specially crafted query | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-16480 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authori… | HIGH 7.1 | 0.3 % | ||
| CVE-2026-18097 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.5 | IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in tra… | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-18096 | 12.1.5 | IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak | LOW 3.3 | 0.1 % | ||
| CVE-2026-10535 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from … | HIGH 8.4 | 0.2 % | ||
| CVE-2026-10695 | 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-7771 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-9762 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control | HIGH 7.8 | 0.2 % | ||
| CVE-2025-36372 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-10109 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-11906 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logi… | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-6938 | 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query | HIGH 7.5 | 0.2 % | ||
| CVE-2026-6053 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-6052 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables | HIGH 7.5 | 0.2 % | ||
| CVE-2026-6051 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap | HIGH 7.5 | 0.2 % | ||
| CVE-2026-1718 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure | HIGH 7.5 | 0.4 % | ||
| CVE-2025-13755 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-1577 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-36122 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.3 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-14688 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.3 | IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-1352 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.4 | IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-36006 | 10.5.0 – 10.5.11 ; 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; … | IBM Db2 denial of service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-36008 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.3 | IBM Db2 denial of service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-36131 | 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.3 | IBM Db2 information disclosure | MEDIUM 4.6 | 0.2 % | ||
| CVE-2025-36136 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.3 | IBM denial of service | MEDIUM 5.5 | 0.1 % | ||
| CVE-2025-36185 | 12.1.0 – 12.1.2 | IBM Db2 denial of service | MEDIUM 6.2 | 0.1 % | ||
| CVE-2025-36186 | 12.1.0 – 12.1.3 | IBM Db2 privilege escalation | HIGH 7.8 | 0.1 % | ||
| CVE-2025-33012 | 10.5.0 – 10.5.11 ; 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; … | IBM Db2 improper account lockout | HIGH 8.8 | 0.2 % | ||
| CVE-2025-2534 | 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.3 | IBM Db2 denial of service | HIGH 7.5 | 0.3 % | ||
| CVE-2024-47118 | 10.5.0 – 10.5.11 ; 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; … | IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query | HIGH 7.5 | 0.3 % | ||
| CVE-2024-49828 | 10.5.0.0 – 10.5.0.11 ; 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; … | IBM Db2 for Linux, UNIX and Windows denial of service | HIGH 7.5 | 0.3 % | ||
| CVE-2024-51473 | 10.5.0.0 – 10.5.0.11 ; 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; … | IBM Db2 for Linux, UNIX and Windows denial of service | HIGH 7.5 | 0.3 % | ||
| CVE-2024-52894 | 10.5.0.0 – 10.5.0.11 ; 11.1.0 – 11.1.4.7 ; 11.5.0 – 11.5.9 ; … | IBM Db2 for Linux, UNIX and Windows denial of service | MEDIUM 4.9 | 0.3 % | ||
| CVE-2025-33114 | 12.1.0 ; 12.1.1 ; 12.1.2 | IBM Db2 for Linux denial of service | HIGH 7.5 | 0.3 % | ||
| CVE-2025-33092 | 11.5.0 – 11.5.9 ; 12.1.0 – 12.1.2 | IBM Db2 for Linux code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2025-36010 | 12.1.0 ; 12.1.1 ; 12.1.2 | IBM Db2 for Linux denial of service | HIGH 7.5 | 0.3 % | ||
| CVE-2025-2533 | 12.1.0 ; 12.1.1 ; 12.1.2 | IBM Db2 for Linux denial of service | HIGH 7.5 | 0.3 % | ||
| CVE-2024-40679 | 11.5 | IBM Db2 information disclosure | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-47145 | 10.5, 11.1, 11.5 | IBM Db2 for Windows privilege escalation | HIGH 8.4 | 0.2 % | ||
| CVE-2019-4014 | 9.7 ; 10.1 ; 10.5 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could | HIGH 8.4 | 0.5 % | ||
| CVE-2018-1936 | 9.7 ; 10.1 ; 10.5 | IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which coul | HIGH 8.4 | 0.5 % |