CVE-2026-10695

IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries...

CVE-2026-10535 IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10535

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc...

CVE-2026-10695

IBM Db2 federated server (12.1.0–12.1.4) is vulnerable to a denial of service when running non-fenced federated queries (CVE-2026-10695). The issue stems from handling of non-fenced federated queries on the federated wrapper, enabling uncontrolled resource consumption leading to DoS. Affected ver...

IBM DB2 Remote Code Execution (7279479) (Unix)

According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities due to Angular [CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267, CVE-2026-54265]

Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to leaking information by transferring cache state to the client-side application CVE-2026-50170 and using a weak hash function for the server-side cached respons...

CVE-2026-14501

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

CVE-2026-14501

CVE-2026-14501 affects IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0. The root cause is the use of potentially dangerous functions without sufficient restrictions, which could allow an attacker to execute arbitrary code or obtain sensitive information. According to the CVSS v3.1 metri...

CVE-2026-7771 IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service...

CVE-2026-9762

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

CVE-2026-9762

CVE-2026-9762 affects IBM Db2 Client components: the IBM Data Server Driver for JDBC and SQLJ. A remote code execution (RCE) exists when the JDBC URL is under user control. Affected products/versions: Db2 client 11.5.0–11.5.9 and 12.1.0–12.1.4. Root cause identified as CWE-94 (Improper Code Gener...

PT-2026-60835

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries (CVE-2026-10695)

Summary IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries. Vulnerability Details CVEID:CVE-2026-10695 DESCRIPTION: IBM Db2 federated server is vulnerable to a denial of service when running non fenced federated queries. CWE:CWE-400: Uncontrolled Resource...

Security Bulletin: Multiple vulnerabilities in IBM Semeru affects IBM® Db2® (April 2026 CPU)

Summary There are vulnerabilities in IBM Runtime Environment Java™ Version 8.0.8.60 and earlier, and IBM Semeru Version 21.0.10.0 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in April 2026 Vulnerability Details CVEID:CVE-2026-22021 DESCRIPTION:...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94: Improper Control of...

Security Bulletin: IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (CVE-2026-10109)

Summary IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling. Vulnerability Details CVEID:CVE-2026-10109 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshak...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub. flatted-3.3.3.tgz , axios-1.15.1.tgz, immutable-4.0.0-rc.12.tgz , lodash-4.17.23.tgz, jspdf-3.0.2.tgz , swiper-11.2.10.tgz , picomatch-2.3.1.tgz , axios-1.12.2.tgz , router-1.23.0.tgz , minimatch-10.2.1.tgz ,...

CVE-2026-10109

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling...

CVE-2025-36372

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows includes Db2 Connect Server could disclose sensitive information to an authenticated user from the monitoring and event tables...

CVE-2025-36372 IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows includes Db2 Connect Server could disclose sensitive information to an authenticated user from the monitoring and event tables...