What’s Vulnerable › Products
IBM Db2 for Linux, UNIX and Windows vulnerabilities
361 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 85 published in the last 12 months.
Check whether your IBM Db2 for Linux, UNIX and Windows version is affected
Latest IBM Db2 for Linux, UNIX and Windows vulnerabilities
- CVE-2026-104364 — IBM® Db2® Denial of Service (CVSS 3.3)
- CVE-2026-104332 — IBM® Db2® Denial of Service (CVSS 5.5)
- CVE-2026-78404 — IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility (CVSS 6.5)
- CVE-2026-18166 — IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem (CVSS 7.7)
- CVE-2026-105466 — IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions (CVSS 6.5)
- CVE-2026-105465 — IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance (CVSS 8.8)
- CVE-2026-105464 — IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management (CVSS 8.8)
- CVE-2026-17463 — IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVSS 6.5)
- CVE-2026-16702 — IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference (CVSS 6.5)
- CVE-2026-15955 — IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths (CVSS 7.5)
- CVE-2026-87958 — IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions (CVSS 8.1)
- CVE-2026-86093 — IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions (CVSS 7.5)
- CVE-2026-86087 — IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system (CVSS 4.3)
- CVE-2026-10534 — IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser (CVSS 9.8)
- CVE-2026-18097 — IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. (CVSS 5.5)
- CVE-2026-18096 — IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak (CVSS 3.3)
- CVE-2026-16480 — IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. (CVSS 7.1)
- CVE-2026-10543 — IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVSS 9.8)
- CVE-2026-10695 — IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries (CVSS 5.5)
- CVE-2026-10535 — IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell (CVSS 7.8)
- CVE-2026-7771 — IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service (CVSS 5.5)
- CVE-2026-9762 — IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVSS 7.8)
- CVE-2026-11906 — IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user (CVSS 6.5)
- CVE-2026-10109 — IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (CVSS 9.8)
- CVE-2025-36372 — IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables (CVSS 6.5)