Skip to content
OpenAdvisories

Product · IBM

Db2

56 known vulnerabilities.

Db2 at a glance

Last 12 months
36
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 4 vulnerabilities May 2026: 6 vulnerabilities June 2026: 3 vulnerabilities, 1 critical Jun July 2026: 4 vulnerabilities August 2026: 5 vulnerabilities September 2026: 6 vulnerabilities Sep October 2026: 7 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202670
Sep 202660
Aug 202650
Jul 202640
Jun 202631
May 202660
Apr 202640
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202590
Oct 202500
Sep 202500
Aug 202500
Jul 202570
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202510
Dec 202400

Latest advisories

  • Medium max 9.1
    WID-SEC-2026-0129 6 CVEs rev. 128

    Golang Go: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

    Google Oracle IBM Red Hat Dell Windows
    first Jan 15, 2026
  • High max 7.5
    WID-SEC-2026-0548 5 CVEs rev. 97

    Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

    Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

    Google Oracle IBM Red Hat Splunk Linux Windows
    first Feb 26, 2026
  • High max 9.1
    WID-SEC-2025-0226 3 CVEs rev. 36

    Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux Advanced Cluster Management ausnutzen, um Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu verursachen.

    IBM Red Hat SUSE Fedora amazon Linux
    first Jan 30, 2025
  • Medium max 5.3
    WID-SEC-2025-2645 2 CVEs rev. 41

    Golang Go: Mehrere Schwachstellen ermöglichen Denial of Service

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen.

    IBM Red Hat Dell F5 Splunk Windows
    first Nov 19, 2025
  • High max 9.8
    WID-SEC-2025-2040 55 CVEs rev. 129

    Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Sicherheitsmechanismen zu umgehen, sowie einen Denial of Service Angriff oder andere nicht spezifizierte Angriffe durchzuführen.

    Google Oracle IBM Red Hat Dell Linux
    first Sep 11, 2025
All Critical High Medium Low Exploited only Public exploit

56 results · Feed

  • Medium 6.5
    CVE-2026-113698

    IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table.

    IBM Db2
  • Low 3.3
    CVE-2026-104364

    IBM® Db2® Denial of Service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

    IBM Db2
  • Medium 5.5
    CVE-2026-104332

    IBM® Db2® Denial of Service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

    IBM Db2
  • High 7.7
    CVE-2026-18166

    IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

    IBM Db2
  • High 8.8
    CVE-2026-105464

    IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

    IBM Db2
  • Medium 6.5
    CVE-2026-105466

    IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

    IBM Db2
  • High 8.8
    CVE-2026-105465

    IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

    IBM Db2
  • Medium 6.5
    CVE-2026-78404

    IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

    IBM Db2
  • High 7.5
    CVE-2026-15955

    IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

    IBM Db2
  • Medium 6.5
    CVE-2026-16702

    IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.

    IBM Db2
  • Medium 6.5
    CVE-2026-17463

    IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

    IBM Db2
  • Medium 4.3
    CVE-2026-86087

    IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

    IBM Db2
  • High 7.5
    CVE-2026-86093

    IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-co…

    IBM Db2
  • High 8.1
    CVE-2026-87958

    IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

    IBM Db2
  • High 8.4
    CVE-2026-10534

    IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.

    IBM Db2
  • High 8.2
    CVE-2026-10543

    IBM® Db2® is vulnerable to privilege escalation with a specially crafted query

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

    IBM Db2
  • Medium 4.3
    CVE-2026-16480

    IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

    IBM Db2
  • Medium 5.5
    CVE-2026-18097

    IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

    IBM Db2
  • Low 3.3
    CVE-2026-18096

    IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak

    IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

    IBM Db2
  • High 8.4
    CVE-2026-10535

    IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

    IBM Db2
  • Medium 6.2
    CVE-2026-10695

    IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries

    IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries.

    IBM Db2
  • Medium 5.5
    CVE-2026-7771

    IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service.

    IBM Db2
  • High 7.8
    CVE-2026-9762

    IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

    IBM Db2
  • Medium 5.5
    CVE-2025-36372

    IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

    IBM Db2
  • Critical 9.8
    CVE-2026-10109

    IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

    IBM Db2
  • Medium 6.5
    CVE-2026-11906

    IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XML…

    IBM Db2
  • Medium 6.5
    CVE-2026-6938

    IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query

    IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query.

    IBM Db2
  • Medium 5.5
    CVE-2026-6053

    IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables.

    IBM Db2
  • Medium 6.5
    CVE-2026-6052

    IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.

    IBM Db2
  • Medium 5.5
    CVE-2026-6051

    IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.

    IBM Db2
  • High 7.1
    CVE-2026-1718

    IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled.

    IBM Db2
  • Medium 5.5
    CVE-2025-13755

    IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user.

    IBM Db2
  • Medium 6.5
    CVE-2026-1577

    IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic.

    IBM Db2
  • Medium 6.5
    CVE-2025-36122

    IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service using a specially crafted SQL query due to improper allocation of system resource…

    IBM Db2
  • Medium 5.3
    CVE-2025-14688

    IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when certa…

    IBM Db2
  • Medium 6.5
    CVE-2026-1352

    IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic.

    IBM Db2
  • Medium 6.5
    CVE-2025-36006

    IBM Db2 denial of service

    IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources af…

    IBM Db2
  • Medium 6.5
    CVE-2025-36008

    IBM Db2 denial of service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.

    IBM Db2
  • Medium 4.6
    CVE-2025-36131

    IBM Db2 information disclosure

    IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access …

    IBM Db2
  • Medium 5.1
    CVE-2025-36136

    IBM denial of service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starti…

    IBM Db2