Ibm vulnerabilities

Published CVEs affecting Ibm products: 1567 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-105052 High · 7.5 CWE-22 Oct 12, 2026

IBM Maximo Application Suite Information Disclosure

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVE-2026-96012 Critical · 9.9 CWE-264 Oct 12, 2026

IBM Db2 Mirror for i Privilege Escalation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

CVE-2026-104364 Low · 3.3 CWE-20 Oct 12, 2026

IBM® Db2® Denial of Service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

CVE-2026-104332 Medium · 5.5 CWE-121 Oct 12, 2026

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service...

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

CVE-2025-27902 Medium · 6.1 CWE-1022 Oct 12, 2026

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted...

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

CVE-2025-27897 Medium · 6.1 CWE-79 Oct 12, 2026

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site...

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-27896 Medium · 6.1 CWE-79 Oct 12, 2026

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site...

CVE-2025-27895 Medium · 6.1 CWE-79 Oct 12, 2026

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site...

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-78404 Medium · 6.5 CWE-269 Oct 12, 2026

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege...

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

CVE-2026-18166 High · 7.7 CWE-284 Oct 12, 2026

IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

CVE-2026-105466 Medium · 6.5 CWE-770 Oct 12, 2026

IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

CVE-2026-105465 High · 8.8 CWE-269 Oct 12, 2026

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation...

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

CVE-2026-105464 High · 8.8 CWE-269 Oct 12, 2026

IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

CVE-2026-87980 Medium · 5.5 CWE-532 Oct 8, 2026

Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.

CVE-2026-84891 High · 7.5 CWE-798 Oct 8, 2026

Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.

CVE-2026-84875 High · 8.8 CWE-119 Oct 8, 2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-84249 Critical · 9.8 CWE-306 Oct 8, 2026

IBM Guardium Data Protection is affected by vulnerability

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

CVE-2026-84247 Medium · 6.5 CWE-22 Oct 8, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

CVE-2026-84246 Critical · 9.8 CWE-120 Oct 8, 2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-84230 Medium · 5.9 CWE-362 Oct 8, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.

CVE-2026-84209 Critical · 9.8 CWE-89 Oct 8, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVE-2026-84198 Critical · 9.8 CWE-120 Oct 8, 2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-84058 Critical · 9.8 CWE-119 Oct 8, 2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.

CVE-2026-84057 Critical · 9.8 CWE-78 Oct 8, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVE-2026-84035 Critical · 9.8 CWE-121 Oct 8, 2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.