CVE-2026-104364

IBM® Db2® Denial of Service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-104332

IBM® Db2® Denial of Service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2025-27902

IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Recovery Expert

CVE-2025-27897

IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Recovery Expert

CVE-2025-27896

IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Recovery Expert

CVE-2025-27895

DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Recovery Expert

CVE-2025-33131

Fixes to common vulnerabilities found in IBM Db2 High Performance Unload

IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix Db2 High Performance Unload Db2 High Performance Unload Load and 3 more

CVE-2026-18104

IBM Db2 Mirror for i is vulnerable to obtain sensitive information []

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-15955

IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-17463

IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-17047

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-16702

IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-86087

IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-86093

IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-87958

IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2

CVE-2026-16660

IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-17483

IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-18567

IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-16708

IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-17184

IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I