CVE-2025-36425
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Feb 17, 2026
CISA due date
—
The record
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. CWE-256
- CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. CWE-256
- CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. CWE-256
- CVE-2026-55164 Lemur manages TLS certificate creation. CWE-256
- CVE-2026-14867 Credentials of built-in users are insecurely stored in the User directory of PcVue… CWE-256
- CVE-2026-57302 Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml… CWE-256
- CVE-2026-50268 Steeltoe is an open source project that provides a collection of libraries that helps… CWE-256
- CVE-2024-39575 update_disk_psu_baseline.sh requires password in plain text CWE-256