CVE-2026-40991

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability due to improper validation of pathnames. A remote authenticated attacker can exploit this to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to an unauthorized actor. A remote authenticated attacker can exploit this to obtain confidential data.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability that can lead to denial of service. A remote authenticated attacker can exploit this to disrupt service availability.

IBM Maximo AI Service 9.1.0 and 9.2.0 contains a vulnerability related to improper control of code generation. A remote attacker can exploit this to execute arbitrary code.

Qexo versions 4.0.0 through 4.2.0 expose /api/init_step/ without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token can reset the INIT setting and re-enter the setup flow, potentially exposing stored PROVIDER configuration including credentials.

Rapyd Admin versions 9.0.0 before 9.20.0 contain hard-coded credentials that allow remote unauthenticated attackers to gain super-admin access through an admin@laravel account with password admin. The account is seeded by the installer and silently re-created on every rpd:make run, bypassing authorization and tenant scoping.

Netcore NR268 version 1.7.121109 contains an argument injection vulnerability in the execvp function of the file /router/DDNSset.cgi in the DDNS component. Manipulating the Hostname argument can lead to argument injection, and the attack can be launched remotely.

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code and gain elevated privileges.

HAProxy Data Plane API versions 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases) have process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS CA is configured and a numeric TLS port is specified, the application globally disables Basic authentication on its shared internal request handler, allowing unauthenticated attackers to reach affected HTTP or UNIX endpoints and completely bypass credentials to gain full API administrative access.