Overview 483 matches · 2 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
483matches
2in Waratek scope0.4%
2protected0.4%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
0.4%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
8
1.7%
Not applicable
473
97.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.4%
partly blocked
0
0.0%
not blocked
481
99.6%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
483
100.0%
split by
peak 96 / year
20011
Not applicable1
Medium1
not blocked1
No public exploit1
20020
20033
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20044
Not applicable4
High3
Medium1
not blocked4
No public exploit4
200517
Not applicable17
High7
Medium8
Low2
not blocked17
No public exploit17
20065
Not applicable5
Medium5
not blocked5
No public exploit5
200729
Not applicable29
High16
Medium11
Low2
not blocked29
No public exploit29
200825
Not applicable25
High13
Medium12
not blocked25
No public exploit25
200931
Not applicable31
High10
Medium20
Low1
not blocked31
No public exploit31
201020
Not applicable20
High5
Medium11
Low4
not blocked20
No public exploit20
20117
Not applicable7
High1
Medium5
Low1
not blocked7
No public exploit7
201213
Not applicable13
High6
Medium6
Low1
not blocked13
No public exploit13
20138
Not applicable8
High1
Medium5
Low2
not blocked8
No public exploit8
201410
Not applicable10
High3
Medium4
Low3
not blocked10
No public exploit10
20156
Not applicable6
High1
Medium4
Low1
not blocked6
No public exploit6
20162
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20179
Not applicable9
High3
Medium4
Low2
not blocked9
No public exploit9
201830
Not applicable30
Critical1
High17
Medium12
not blocked30
No public exploit30
201919
Not applicable19
High15
Medium4
not blocked19
No public exploit19
202014
Outside Waratek scope1
Not applicable13
High6
Medium8
not blocked14
No public exploit14
202118
Outside Waratek scope7
Not applicable11
High10
Medium8
not blocked18
No public exploit18
20228
Not applicable8
High4
Medium4
not blocked8
No public exploit8
202344
Not applicable44
Critical1
High36
Medium7
not blocked44
No public exploit44
202430
Not applicable30
High6
Medium24
not blocked30
No public exploit30
202534
Protected by Waratek1
Not applicable33
High14
Medium20
blocked by ARMR today1
not blocked33
No public exploit34
202696
Protected by Waratek1
Not applicable95
Critical10
High26
Medium58
Low2
blocked by ARMR today1
not blocked95
No public exploit96
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-116376 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability. |
| CVE-2026-110283 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers. |
| CVE-2026-110282 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control. |
| CVE-2026-110281 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique. |
| CVE-2026-108910 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step. |
| CVE-2026-108838 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption. |
| CVE-2026-108767 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers. |
| CVE-2026-108588 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing. |
| CVE-2026-108536 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames. |
| CVE-2026-105991 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header. |
| CVE-2026-105702 | Medium | 2026-11-04 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details. |
| CVE-2026-18104 | Low | 2026-09-24 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption. |
| CVE-2026-87958 | High | 2026-09-10 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions. |
| CVE-2026-86093 | High | 2026-09-10 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking. |
| CVE-2026-86087 | Medium | 2026-09-10 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system. |
| CVE-2026-18567 | Medium | 2026-09-04 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory. |
| CVE-2026-17483 | Medium | 2026-09-04 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure. |
| CVE-2026-16660 | Medium | 2026-09-04 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. |
| CVE-2026-18554 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. |
| CVE-2026-18178 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. |
| CVE-2026-17227 | Medium | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command. |
| CVE-2026-17209 | Medium | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. |
| CVE-2026-17186 | Critical | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command. |
| CVE-2026-17184 | Critical | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path. |
| CVE-2026-17182 | Critical | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments. |
| CVE-2026-17181 | Critical | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal. |
| CVE-2026-17179 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection. |
| CVE-2026-17177 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
| CVE-2026-17175 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement. |
| CVE-2026-17173 | Medium | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths. |
| CVE-2026-17081 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory. |
| CVE-2026-17079 | Medium | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter. |
| CVE-2026-16915 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. |
| CVE-2026-16905 | Medium | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication. |
| CVE-2026-16879 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input. |
| CVE-2026-16708 | High | 2026-08-14 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration. |
| CVE-2026-18097 | Medium | 2026-08-12 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. |
| CVE-2026-18096 | Low | 2026-08-12 | Not applicable | No public exploit | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak. |
| CVE-2026-16956 | Critical | 2026-08-12 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. |
| CVE-2026-16480 | High | 2026-08-12 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. |
| CVE-2026-10543 | Critical | 2026-08-12 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. |
| CVE-2026-10534 | Critical | 2026-08-12 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser. |
| CVE-2026-10695 | Medium | 2026-07-30 | Not applicable | No public exploit | IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries. |
| CVE-2026-10535 | High | 2026-07-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc. |
| CVE-2026-9762 | High | 2026-07-17 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. |
| CVE-2026-7771 | Medium | 2026-07-17 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service. |
| CVE-2026-14501 | Critical | 2026-07-17 | Not applicable | No public exploit | IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions. |
| CVE-2026-11906 | Medium | 2026-06-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns. |
| CVE-2026-10109 | Critical | 2026-06-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling. |
| CVE-2025-36372 | Medium | 2026-06-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables. |
| CVE-2025-2669 | Medium | 2026-06-22 | Not applicable | No public exploit | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation. |
| CVE-2024-54178 | Medium | 2026-06-22 | Not applicable | No public exploit | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources. |
| CVE-2023-33854 | Medium | 2026-06-22 | Not applicable | No public exploit | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques. |
| CVE-2025-27511 | High | 2026-06-18 | Protected by Waratek | No public exploit | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue. |
| CVE-2026-6938 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query. |
| CVE-2026-6053 | Medium | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables. |
| CVE-2026-6052 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables. |
| CVE-2026-6051 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap. |
| CVE-2026-1718 | High | 2026-05-27 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a specially crafted query when autonomous transactions are enabled. |
| CVE-2025-13755 | Medium | 2026-05-26 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user. |
| CVE-2026-1577 | Medium | 2026-04-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic. |
| CVE-2025-36122 | Medium | 2026-04-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service using a specially crafted SQL query due to improper allocation of system resources. |
| CVE-2025-14688 | Medium | 2026-04-30 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when certain configurations exist. |
| CVE-2026-1352 | Medium | 2026-04-23 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic. |
| CVE-2026-3856 | Critical | 2026-03-17 | Not applicable | No public exploit | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission. |
| CVE-2025-36425 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration. |
| CVE-2025-36247 | High | 2026-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. |
| CVE-2025-33130 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack. |
| CVE-2025-33124 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size. |
| CVE-2025-27904 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. |
| CVE-2025-27903 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows transmits data in a cleartext communication channel that could allow an attacker to obtain sensitive information using man in the middle techniques. |
| CVE-2025-27901 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. |
| CVE-2025-27900 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. |
| CVE-2025-27899 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system. |
| CVE-2025-27898 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 does not invalidate session after a timeout which could allow an authenticated user to impersonate another user on the system. |
| CVE-2025-14689 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects. |
| CVE-2025-13867 | Medium | 2026-02-17 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic |
| CVE-2025-13108 | High | 2026-02-17 | Not applicable | No public exploit | IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources. |
| CVE-2025-36442 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns. |
| CVE-2025-36428 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic when the RPSCAN feature is enabled. |
| CVE-2025-36427 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special elements in data query logic. |
| CVE-2025-36424 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic. |
| CVE-2025-36423 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. |
| CVE-2025-36407 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. |
| CVE-2025-36387 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query. |
| CVE-2025-36384 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element. |
| CVE-2025-36366 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination. |
| CVE-2025-36365 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key. |
| CVE-2025-36353 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. |
| CVE-2025-36184 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. |
| CVE-2025-36123 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources. |
| CVE-2025-36098 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources. |
| CVE-2025-36070 | High | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. |
| CVE-2025-36009 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable. |
| CVE-2025-36001 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion. |
| CVE-2025-2668 | Medium | 2026-01-30 | Not applicable | No public exploit | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query. |
| CVE-2025-14687 | Medium | 2025-12-26 | Not applicable | No public exploit | IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms. |
| CVE-2025-36186 | High | 2025-11-07 | Not applicable | No public exploit | IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. |
| CVE-2025-36185 | Medium | 2025-11-07 | Not applicable | No public exploit | IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. |
| CVE-2025-36136 | Medium | 2025-11-07 | Not applicable | No public exploit | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions. |