CVE Tools
Track your stack

DB2

362 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for DB2, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.

DB2 CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
DB2 CVEs per month
MonthCVEs
2024-123
2025-011
2025-020
2025-030
2025-040
2025-058
2025-060
2025-078
2025-080
2025-090
2025-100
2025-119
2025-120
2026-0118
2026-024
2026-030
2026-044
2026-056
2026-066
2026-074
2026-085
2026-096
2026-107
2026-111

Severity

How the 362 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical144%
  • High10429%
  • Medium22763%
  • Low175%

Latest CVEs

The 15 most recently published vulnerabilities affecting DB2.

  1. CVE-2026-113698IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table6.5
  2. CVE-2026-104364IBM® Db2® Denial of Service3.3
  3. CVE-2026-104332IBM® Db2® Denial of Service5.5
  4. CVE-2026-18166IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem7.7
  5. CVE-2026-105464IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management8.8
  6. CVE-2026-105466IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions6.5
  7. CVE-2026-105465IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance8.8
  8. CVE-2026-78404IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility6.5
  9. CVE-2026-15955IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths7.5
  10. CVE-2026-16702IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference6.5
  11. CVE-2026-17463IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption6.5
  12. CVE-2026-86087IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system4.3
  13. CVE-2026-86093IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions7.5
  14. CVE-2026-87958IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions8.1
  15. CVE-2026-10534IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser8.4

Product grouping is registry-driven, with AI assist and human review. How it works