JVNRSS Feed - JP
type: channel
link: https://jvn.jp/
description: JVNRSS Feed - Update Entry
publisher: JVN
date: 2026-09-02T11:33:57+09:00
issued: 2026-09-02T11:33:57+09:00
modified: 2026-09-02T11:33:57+09:00
items: Multiple vulnerabilities in ShizenBox2
items: PALLET CONTROL products vulnerable to improper access control
items: Multiple vulnerabilities in GROWI
items: Multiple vulnerabilities in SOY series
items: Zabbix agent may insecurely load Dynamic Link Libraries
items: Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries
items: Android App "Myna Point" vulnerable to improper access restriction
items: Multiple vulnerabilities in CorvusSKK
items: Apache Struts 2 vulnerable to resource exhaustion
items: Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
items: Sakura Editor vulnerable to OS command injection
items: UNIVERGE IX-R/IX-V series routers vulnerable to missing authentication for critical function
items: Miraikan Assist App vulnerable to cross-site scripting
items: Multiple vulnerabilities in acmailer
items: Apache Allura vulnerable to server-side request forgery
items: F-RevoCRM vulnerable to cross-site scripting
items: miChecker improper restriction of XML external entity references
items: Improper file access permission settings in Synology Assistant
items: VoiceTra vulnerable to incorrectly specified destination in a communication channel
items: Installer for LINE for Windows insecurely loads Dynamic Link Libraries
items: Multiple vulnerabilities in NetKids iMark
items: freo2 vulnerable to unrestricted upload of file with dangerous type
items: Cybozu Garoon vulnerable to cross-site scripting
items: Permissive regular expression vulnerability in Tegalog -Fumy Otegaru Memo Logger-
items: Multiple vulnerabilities in ELECOM wireless LAN routers and access points (July 2026)
items: Ricoh printers and Multifunction Printers (MFPs) missing restriction on SSH port forwarding
items: Drupal plugin "AI Agents" vulnerable to incorrect authorization
items: Vulnerability in certain IC chips of contactless IC card "FeliCa"
items: Multiple vulnerabilities in TTSSH2 plugin of Tera Term
items: Installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries
items: Multiple vulnerabilities in the installer for Pupsman
items: SEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery
items: Seiko Solutions SkyBridge MB-A100/MB-A110 vulnerable to OS command injection
items: Reflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
items: RPG MAKER MV and MZ vulnerable to OS command injection
items: DGM3103SCT vulnerable to OS command injection
items: Multiple vulnerabilities in Fluentd
items: ExpressUpdate Agent for Windows improper access restriction on its named pipe
items: OS command injection in RadiX AX6600 WiFi 6 Tri-Band Gaming Router
items: ThingsBoard vulnerable to prototype pollution
items: Improper file access permission settings in the installers for Optical Disc Archive Software for Windows
items: Privilege escalation vulnerability in multiple RICOH and KONICA MINOLTA JAPAN printer drivers
items: CamView installer insecurely loads Dynamic Link Libraries
items: Multiple TP-Link products vulnerable to cleartext transmission of sensitive information
items: WordPress Plugin "Zoho Mail for WordPress" vulnerable to cross-site request forgery
items: Multiple vulnerabilities in ServerView Agents for Windows
items: Jupyter Server vulnerable to open redirect
items: NEC Aterm series vulnerable to OS command injection (NV26-003)
items: NEC Aterm series vulnerable to cross-site scripting (NV26-002)
items: Movable Type vulnerable to missing authorization
items: Multiple vulnerabilities in "Musetheque V4 Information Disclosure for IPKNOWLEDGE"
items: WPS Office improper access restriction to its named pipe
items: GUARDIANWALL MailSuite vulnerable to stack-based buffer overflow
items: Android App "あんしんフィルター for au" vulnerable to cleartext transmission of sensitive information
items: Bytello Share (Windows Edition) installer executable insecurely loads Dynamic Link Libraries
items: Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)
items: GROWI vulnerable to path traversal
items: "Kura Sushi Official App" vulnerable to improper certificate validation
items: libXpm vulnerable to out-of-bounds read
items: Lhaz and Lhaz+ vulnerable to path traversal
items: Open redirect vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
items: Apache ActiveMQ series improper validation of MQTT packets [AMQ-9810]
items: GROWI vulnerable to Regular expression Denial-of-Service (ReDoS)
items: Multiple vulnerabilities in LogonTracer
items: IP Setting Software may insecurely load Dynamic Link Libraries
items: CMS ALAYA vulnerable to SQL injection
items: Ziostation2 vulnerable to path traversal
items: Installers of LiveOn Meet Client for Windows and its plugin may insecurely load Dynamic Link Libraries
items: DeepL Chrome browser extension vulnerable to cross-site scripting
items: SKYSEA Client View and SKYMEC IT Manager improper file access permission settings
items: Multiple vulnerabilities in CubeCart
items: Arcserve UDP Console vulnerable to redirect to a dummy URL

Multiple vulnerabilities in ShizenBox2
type: item
description: ShizenBox2 provided by Shizen Connect Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-09-02T12:00:00+09:00
issued: 2026-09-02T12:00:00+09:00
modified: 2026-09-02T12:00:00+09:00

PALLET CONTROL products vulnerable to improper access control
type: item
description: PALLET CONTROL products provided by JAL Information Technology Co., Ltd. contains an improper access control vulnerability.
publisher: JVN
date: 2026-09-01T12:00:00+09:00
issued: 2026-09-01T12:00:00+09:00
modified: 2026-09-01T12:00:00+09:00

Multiple vulnerabilities in GROWI
type: item
description: GROWI provided by GROWI, Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-08-28T14:00:00+09:00
issued: 2026-08-28T14:00:00+09:00
modified: 2026-08-28T14:00:00+09:00

Multiple vulnerabilities in SOY series
type: item
description: SOY series provided by Tsuyoshi Saito contain multiple vulnerabilities.
publisher: JVN
date: 2026-08-28T12:00:15+09:00
issued: 2026-08-28T12:00:15+09:00
modified: 2026-08-28T12:00:15+09:00

Zabbix agent may insecurely load Dynamic Link Libraries
type: item
description: Zabbix agent provided by Zabbix LLC may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-08-28T12:00:00+09:00
issued: 2026-08-28T12:00:00+09:00
modified: 2026-08-28T12:00:00+09:00

Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries
type: item
description: The installer for Rakuten Kobo Desktop Application (Windows version) provided by Rakuten Kobo Inc. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-08-27T12:00:00+09:00
issued: 2026-08-27T12:00:00+09:00
modified: 2026-08-27T12:00:00+09:00

Android App "Myna Point" vulnerable to improper access restriction
type: item
description: Android App "Myna Point" provided by Digital Agency contains an improper access restriction vulnerability.
publisher: JVN
date: 2026-08-26T12:00:15+09:00
issued: 2026-08-26T12:00:15+09:00
modified: 2026-08-26T12:00:15+09:00

Multiple vulnerabilities in CorvusSKK
type: item
description: CorvusSKK provided by SASAKI Nobuyuki contains multiple vulnerabilities.
publisher: JVN
date: 2026-08-26T12:00:00+09:00
issued: 2026-08-26T12:00:00+09:00
modified: 2026-08-26T12:00:00+09:00

Apache Struts 2 vulnerable to resource exhaustion
type: item
description: Apache Struts 2 provided by The Apache Software Foundation contains a resource exhaustion vulnerability.
publisher: JVN
date: 2026-08-25T12:00:00+09:00
issued: 2026-08-25T12:00:00+09:00
modified: 2026-08-25T12:00:00+09:00

Multiple vulnerabilities in SKYSEA Client View and SKYMEC IT Manager
type: item
description: SKYSEA Client View and SKYMEC IT Manager provided by Sky Co., LTD. contains multiple vulnerabilities.
publisher: JVN
date: 2026-08-24T14:00:00+09:00
issued: 2026-08-24T14:00:00+09:00
modified: 2026-08-24T14:00:00+09:00

Sakura Editor vulnerable to OS command injection
type: item
description: Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability.
publisher: JVN
date: 2026-08-24T12:00:00+09:00
issued: 2026-08-24T12:00:00+09:00
modified: 2026-08-24T12:00:00+09:00

UNIVERGE IX-R/IX-V series routers vulnerable to missing authentication for critical function
type: item
description: UNIVERGE IX-R/IX-V series routers provided by NEC Corporation contain a missing authentication for critical function vulnerability.
publisher: JVN
date: 2026-08-21T14:00:00+09:00
issued: 2026-08-21T14:00:00+09:00
modified: 2026-08-21T14:00:00+09:00

Miraikan Assist App vulnerable to cross-site scripting
type: item
description: Miraikan Assist App provided by Japan Science and Technology Agency (JST) contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-08-21T12:00:00+09:00
issued: 2026-08-21T12:00:00+09:00
modified: 2026-08-21T12:00:00+09:00

Multiple vulnerabilities in acmailer
type: item
description: acmailer provided by Extra Innovation Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-08-19T12:00:00+09:00
issued: 2026-08-19T12:00:00+09:00
modified: 2026-08-19T12:00:00+09:00

Apache Allura vulnerable to server-side request forgery
type: item
description: Apache Allura provided by The Apache Software Foundation contains a server-side request forgery vulnerability.
publisher: JVN
date: 2026-08-18T12:00:00+09:00
issued: 2026-08-18T12:00:00+09:00
modified: 2026-08-18T12:00:00+09:00

F-RevoCRM vulnerable to cross-site scripting
type: item
description: F-RevoCRM provided by Thinkingreed Inc. contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-08-17T14:00:00+09:00
issued: 2026-08-17T14:00:00+09:00
modified: 2026-08-17T14:00:00+09:00

miChecker improper restriction of XML external entity references
type: item
description: miChecker developed by Eclipse Foundation and provided by Ministry of Internal Affairs and Communications improperly restricts XML external entity references.
publisher: JVN
date: 2026-08-17T12:00:30+09:00
issued: 2026-08-17T12:00:30+09:00
modified: 2026-08-17T12:00:30+09:00

Improper file access permission settings in Synology Assistant
type: item
description: Synology Assistant provided by Synology Inc. is configured with an improper file access permission settings.
publisher: JVN
date: 2026-08-17T12:00:00+09:00
issued: 2026-08-17T12:00:00+09:00
modified: 2026-08-17T12:00:00+09:00

VoiceTra vulnerable to incorrectly specified destination in a communication channel
type: item
description: VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains a vulnerability due to incorrectly specified destination in a communication channel.
publisher: JVN
date: 2026-08-13T12:00:00+09:00
issued: 2026-08-13T12:00:00+09:00
modified: 2026-08-13T12:00:00+09:00

Installer for LINE for Windows insecurely loads Dynamic Link Libraries
type: item
description: The installer for LINE for Windows provided by LY Corporation insecurely loads Dynamic Link Libraries.
publisher: JVN
date: 2026-08-10T16:00:00+09:00
issued: 2026-08-10T16:00:00+09:00
modified: 2026-08-10T16:00:00+09:00

Multiple vulnerabilities in NetKids iMark
type: item
description: NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-08-05T12:00:00+09:00
issued: 2026-08-05T12:00:00+09:00
modified: 2026-08-05T12:00:00+09:00

freo2 vulnerable to unrestricted upload of file with dangerous type
type: item
description: freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability.
publisher: JVN
date: 2026-08-04T12:00:00+09:00
issued: 2026-08-04T12:00:00+09:00
modified: 2026-08-04T12:00:00+09:00

Cybozu Garoon vulnerable to cross-site scripting
type: item
description: Cybozu Garoon provided by Cybozu, Inc contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-08-03T12:00:00+09:00
issued: 2026-08-03T12:00:00+09:00
modified: 2026-08-03T12:00:00+09:00

Permissive regular expression vulnerability in Tegalog -Fumy Otegaru Memo Logger-
type: item
description: Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression.
publisher: JVN
date: 2026-07-29T12:00:00+09:00
issued: 2026-07-29T12:00:00+09:00
modified: 2026-07-29T12:00:00+09:00

Multiple vulnerabilities in ELECOM wireless LAN routers and access points (July 2026)
type: item
description: Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities.
publisher: JVN
date: 2026-07-28T14:00:00+09:00
issued: 2026-07-28T14:00:00+09:00
modified: 2026-07-28T14:00:00+09:00

Ricoh printers and Multifunction Printers (MFPs) missing restriction on SSH port forwarding
type: item
description: Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do not implement restrictions on SSH port forwarding, allowing to connect to arbitrary destinations.
publisher: JVN
date: 2026-07-23T14:00:00+09:00
issued: 2026-07-23T14:00:00+09:00
modified: 2026-07-23T14:00:00+09:00

Drupal plugin "AI Agents" vulnerable to incorrect authorization
type: item
description: AI Agents provided by Drupal contains an incorrect authorization vulnerability.
publisher: JVN
date: 2026-07-21T12:00:15+09:00
issued: 2026-07-21T12:00:15+09:00
modified: 2026-07-21T12:00:15+09:00

Vulnerability in certain IC chips of contactless IC card "FeliCa"
type: item
description: For certain FeliCa IC chips shipped by Sony Corporation in or before 2017, a certain operation during cryptographic processing may compromise the intended security strength.
publisher: JVN
date: 2026-07-21T12:00:00+09:00
issued: 2026-07-21T12:00:00+09:00
modified: 2026-07-21T12:00:00+09:00

Multiple vulnerabilities in TTSSH2 plugin of Tera Term
type: item
description: TTSSH2 plugin of Tera Term provided by TeraTerm Project contains multiple vulnerabilities.
publisher: JVN
date: 2026-07-16T12:00:00+09:00
issued: 2026-07-16T12:00:00+09:00
modified: 2026-07-16T12:00:00+09:00

Installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries
type: item
description: Installer of HYPER SBI 2 provided by SBI SECURITIES Co.,Ltd. insecurely loads Dynamic Link Libraries.
publisher: JVN
date: 2026-07-15T12:00:00+09:00
issued: 2026-07-15T12:00:00+09:00
modified: 2026-07-15T12:00:00+09:00

Multiple vulnerabilities in the installer for Pupsman
type: item
description: The installer for Pupsman provided by Fuji Electric Co.,Ltd. contains multiple vulnerabilities.
publisher: JVN
date: 2026-07-08T12:00:00+09:00
issued: 2026-07-08T12:00:00+09:00
modified: 2026-07-08T12:00:00+09:00

SEIKO EPSON printers and scanners Web Config vulnerable to cross-site request forgery
type: item
description: Web Config embedded in SEIKO EPSON multiple printers and scanners contains a cross-site request forgery vulnerability.
publisher: JVN
date: 2026-07-07T14:00:00+09:00
issued: 2026-07-07T14:00:00+09:00
modified: 2026-07-07T14:00:00+09:00

Seiko Solutions SkyBridge MB-A100/MB-A110 vulnerable to OS command injection
type: item
description: SkyBridge MB-A100/MB-A110 provided by Seiko Solutions Inc. contains an OS command injection vulnerability.
publisher: JVN
date: 2026-07-01T14:00:00+09:00
issued: 2026-07-01T14:00:00+09:00
modified: 2026-07-01T14:00:00+09:00

Reflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
type: item
description: Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability.
publisher: JVN
date: 2026-06-30T14:00:15+09:00
issued: 2026-06-30T14:00:15+09:00
modified: 2026-06-30T14:00:15+09:00

RPG MAKER MV and MZ vulnerable to OS command injection
type: item
description: RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability.
publisher: JVN
date: 2026-06-30T14:00:00+09:00
issued: 2026-06-30T14:00:00+09:00
modified: 2026-06-30T14:00:00+09:00

DGM3103SCT vulnerable to OS command injection
type: item
description: DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability.
publisher: JVN
date: 2026-06-30T12:00:00+09:00
issued: 2026-06-30T12:00:00+09:00
modified: 2026-06-30T12:00:00+09:00

Multiple vulnerabilities in Fluentd
type: item
description: Fluentd provided by Fluentd Project contains multiple vulnerabilities.
publisher: JVN
date: 2026-06-29T12:00:00+09:00
issued: 2026-06-29T12:00:00+09:00
modified: 2026-06-29T12:00:00+09:00

ExpressUpdate Agent for Windows improper access restriction on its named pipe
type: item
description: ExpressUpdate Agent for Windows provided by NEC Corporation configures its named pipe with an improper access restriction.
publisher: JVN
date: 2026-06-26T14:00:00+09:00
issued: 2026-06-26T14:00:00+09:00
modified: 2026-06-26T14:00:00+09:00

OS command injection in RadiX AX6600 WiFi 6 Tri-Band Gaming Router
type: item
description: RadiX AX6600 WiFi 6 Tri-Band Gaming Router provided by Micro-Star International Co., Ltd. contains an OS command injection vulnerability.
publisher: JVN
date: 2026-06-17T12:00:00+09:00
issued: 2026-06-17T12:00:00+09:00
modified: 2026-06-17T12:00:00+09:00

ThingsBoard vulnerable to prototype pollution
type: item
description: ThingsBoard contains a prototype pollution vulnerability.
publisher: JVN
date: 2026-06-16T12:00:15+09:00
issued: 2026-06-16T12:00:15+09:00
modified: 2026-06-16T12:00:15+09:00

Improper file access permission settings in the installers for Optical Disc Archive Software for Windows
type: item
description: Optical Disc Archive Software for Windows provided by Sony Corporation is configured with improper file access permission settings.
publisher: JVN
date: 2026-06-16T12:00:00+09:00
issued: 2026-06-16T12:00:00+09:00
modified: 2026-06-16T12:00:00+09:00

Privilege escalation vulnerability in multiple RICOH and KONICA MINOLTA JAPAN printer drivers
type: item
description: Multiple printer drivers provided by RICOH and KONICA MINOLTA JAPAN contain a privilege escalation vulnerability.
publisher: JVN
date: 2026-06-15T14:00:00+09:00
issued: 2026-06-15T14:00:00+09:00
modified: 2026-06-15T14:00:00+09:00

CamView installer insecurely loads Dynamic Link Libraries
type: item
description: CamView installer provided by ARUCOM Inc. insecurely loads Dynamic Link Libraries.
publisher: JVN
date: 2026-06-09T12:00:00+09:00
issued: 2026-06-09T12:00:00+09:00
modified: 2026-06-09T12:00:00+09:00

Multiple TP-Link products vulnerable to cleartext transmission of sensitive information
type: item
description: Multiple TP-Link products provided by TP-Link Systems Inc. contain Cleartext Transmission of Sensitive Information (CWE-319) vulnerability.
publisher: JVN
date: 2026-06-05T12:00:00+09:00
issued: 2026-06-05T12:00:00+09:00
modified: 2026-06-05T12:00:00+09:00

WordPress Plugin "Zoho Mail for WordPress" vulnerable to cross-site request forgery
type: item
description: WordPress plugin "Zoho Mail for WordPress" provided by Zoho Corporation contains a cross-site request forgery vulnerability.
publisher: JVN
date: 2026-06-03T12:00:00+09:00
issued: 2026-06-03T12:00:00+09:00
modified: 2026-06-03T12:00:00+09:00

Multiple vulnerabilities in ServerView Agents for Windows
type: item
description: ServerView Agents for Windows provided by Fsas Technologies Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-06-01T12:00:00+09:00
issued: 2026-06-01T12:00:00+09:00
modified: 2026-06-01T12:00:00+09:00

Jupyter Server vulnerable to open redirect
type: item
description: Jupyter Server provided by Jupyter Development Team contains an open redirect vulnerability.
publisher: JVN
date: 2026-05-28T12:00:00+09:00
issued: 2026-05-28T12:00:00+09:00
modified: 2026-05-28T12:00:00+09:00

NEC Aterm series vulnerable to OS command injection (NV26-003)
type: item
description: NEC Aterm series products provided by NEC Corporation contain an OS command injection vulnerability.
publisher: JVN
date: 2026-05-25T12:00:15+09:00
issued: 2026-05-25T12:00:15+09:00
modified: 2026-05-25T12:00:15+09:00

NEC Aterm series vulnerable to cross-site scripting (NV26-002)
type: item
description: Aterm series products provided by NEC Corporation contain a cross-site scripting vulnerability.
publisher: JVN
date: 2026-05-25T12:00:00+09:00
issued: 2026-05-25T12:00:00+09:00
modified: 2026-05-25T12:00:00+09:00

Movable Type vulnerable to missing authorization
type: item
description: Movable Type provided by Six Apart Ltd. contains a missing authorization vulnerability.
publisher: JVN
date: 2026-05-20T14:00:00+09:00
issued: 2026-05-20T14:00:00+09:00
modified: 2026-05-20T14:00:00+09:00

Multiple vulnerabilities in "Musetheque V4 Information Disclosure for IPKNOWLEDGE"
type: item
description: Musetheque V4 Information Disclosure for IPKNOWLEDGE provided by Fujitsu Japan Limited contains multiple vulnerabilities.
publisher: JVN
date: 2026-05-15T12:00:00+09:00
issued: 2026-05-15T12:00:00+09:00
modified: 2026-05-15T12:00:00+09:00

WPS Office improper access restriction to its named pipe
type: item
description: WPS Office provided by WPS SOFTWARE PTE. LTD. fails to properly restrict access to its named pipe.
publisher: JVN
date: 2026-05-14T12:00:00+09:00
issued: 2026-05-14T12:00:00+09:00
modified: 2026-05-14T12:00:00+09:00

GUARDIANWALL MailSuite vulnerable to stack-based buffer overflow
type: item
description: GUARDIANWALL MailSuite provided by Canon Marketing Japan Inc. contains a stack-based buffer overflow vulnerability.
publisher: JVN
date: 2026-05-13T14:00:00+09:00
issued: 2026-05-13T14:00:00+09:00
modified: 2026-05-13T14:00:00+09:00

Android App "あんしんフィルター for au" vulnerable to cleartext transmission of sensitive information
type: item
description: Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability.
publisher: JVN
date: 2026-05-13T12:00:15+09:00
issued: 2026-05-13T12:00:15+09:00
modified: 2026-05-13T12:00:15+09:00

Bytello Share (Windows Edition) installer executable insecurely loads Dynamic Link Libraries
type: item
description: Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries.
publisher: JVN
date: 2026-05-13T12:00:00+09:00
issued: 2026-05-13T12:00:00+09:00
modified: 2026-05-13T12:00:00+09:00

Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)
type: item
description: Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities.
publisher: JVN
date: 2026-05-12T14:00:00+09:00
issued: 2026-05-12T14:00:00+09:00
modified: 2026-05-12T14:00:00+09:00

GROWI vulnerable to path traversal
type: item
description: GROWI provided by GROWI, Inc. contains a path traversal vulnerability.
publisher: JVN
date: 2026-05-11T15:00:00+09:00
issued: 2026-05-11T15:00:00+09:00
modified: 2026-05-11T15:00:00+09:00

"Kura Sushi Official App" vulnerable to improper certificate validation
type: item
description: "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation.
publisher: JVN
date: 2026-05-11T12:00:30+09:00
issued: 2026-05-11T12:00:30+09:00
modified: 2026-05-11T12:00:30+09:00

libXpm vulnerable to out-of-bounds read
type: item
description: libXpm provided by X.Org Foundation contains an out-of-bounds read vulnerability.
publisher: JVN
date: 2026-05-11T12:00:10+09:00
issued: 2026-05-11T12:00:10+09:00
modified: 2026-05-11T12:00:10+09:00

Lhaz and Lhaz+ vulnerable to path traversal
type: item
description: Lhaz and Lhaz+ provided by Chitora soft contain a path traversal vulnerability.
publisher: JVN
date: 2026-05-11T12:00:00+09:00
issued: 2026-05-11T12:00:00+09:00
modified: 2026-05-11T12:00:00+09:00

Open redirect vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor
type: item
description: Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain an open redirect vulnerability.
publisher: JVN
date: 2026-04-30T14:00:00+09:00
issued: 2026-04-30T14:00:00+09:00
modified: 2026-04-30T14:00:00+09:00

Apache ActiveMQ series improper validation of MQTT packets [AMQ-9810]
type: item
description: Apache ActiveMQ series provided by The Apache Software Foundation does not properly validate MQTT packets.
publisher: JVN
date: 2026-04-24T12:00:00+09:00
issued: 2026-04-24T12:00:00+09:00
modified: 2026-04-24T12:00:00+09:00

GROWI vulnerable to Regular expression Denial-of-Service (ReDoS)
type: item
description: GROWI provided by GROWI, Inc. contains a Regular expression Denial-of-Service (DoS) vulnerability.
publisher: JVN
date: 2026-04-23T15:00:00+09:00
issued: 2026-04-23T15:00:00+09:00
modified: 2026-04-23T15:00:00+09:00

Multiple vulnerabilities in LogonTracer
type: item
description: LogonTracer provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) contains multiple vulnerabilities.
publisher: JVN
date: 2026-04-23T14:00:00+09:00
issued: 2026-04-23T14:00:00+09:00
modified: 2026-04-23T14:00:00+09:00

IP Setting Software may insecurely load Dynamic Link Libraries
type: item
description: IP Setting Software provided by i-PRO Co., Ltd. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-04-23T12:00:15+09:00
issued: 2026-04-23T12:00:15+09:00
modified: 2026-04-23T12:00:15+09:00

CMS ALAYA vulnerable to SQL injection
type: item
description: CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability.
publisher: JVN
date: 2026-04-23T12:00:00+09:00
issued: 2026-04-23T12:00:00+09:00
modified: 2026-04-23T12:00:00+09:00

Ziostation2 vulnerable to path traversal
type: item
description: Ziostation2 provided by Ziosoft, Inc. contains a path traversal vulnerability.
publisher: JVN
date: 2026-04-22T14:00:15+09:00
issued: 2026-04-22T14:00:15+09:00
modified: 2026-04-22T14:00:15+09:00

Installers of LiveOn Meet Client for Windows and its plugin may insecurely load Dynamic Link Libraries
type: item
description: The installer of LiveOn Meet Client for Windows and the installer of Canon Network Camera Plugin provided by Japan Media Systems Corporation may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-04-22T14:00:00+09:00
issued: 2026-04-22T14:00:00+09:00
modified: 2026-04-22T14:00:00+09:00

DeepL Chrome browser extension vulnerable to cross-site scripting
type: item
description: DeepL Chrome browser extension contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-04-22T12:00:00+09:00
issued: 2026-04-22T12:00:00+09:00
modified: 2026-04-22T12:00:00+09:00

SKYSEA Client View and SKYMEC IT Manager improper file access permission settings
type: item
description: SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configures the installation folder with improper file access permission settings.
publisher: JVN
date: 2026-04-20T14:00:00+09:00
issued: 2026-04-20T14:00:00+09:00
modified: 2026-04-20T14:00:00+09:00

Multiple vulnerabilities in CubeCart
type: item
description: CubeCart provided by CubeCart Limited contains multiple vulnerabilities.
publisher: JVN
date: 2026-04-17T12:00:00+09:00
issued: 2026-04-17T12:00:00+09:00
modified: 2026-04-17T12:00:00+09:00

Arcserve UDP Console vulnerable to redirect to a dummy URL
type: item
description: Offline activation traffic of UDP Console provided by Arcserve may be redirected to a dummy URL.
publisher: JVN
date: 2026-04-16T12:00:00+09:00
issued: 2026-04-16T12:00:00+09:00
modified: 2026-04-16T12:00:00+09:00

GROWI vulnerable to stored cross-site scripting
type: item
description: GROWI provided by GROWI, Inc. contains a stored cross-site scripting vulnerability.
publisher: JVN
date: 2026-04-15T12:00:00+09:00
issued: 2026-04-15T12:00:00+09:00
modified: 2026-04-15T12:00:00+09:00

EmoCheck loads Dynamic Link Libraries insecurely
type: item
description: EmoCheck provided by Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) loads Dynamic Link Libraries insecurely.
publisher: JVN
date: 2026-04-10T12:00:00+09:00
issued: 2026-04-10T12:00:00+09:00
modified: 2026-04-10T12:00:00+09:00

Multiple vulnerabilities in Movable Type
type: item
description: Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities.
publisher: JVN
date: 2026-04-08T14:00:00+09:00
issued: 2026-04-08T14:00:00+09:00
modified: 2026-04-08T14:00:00+09:00

Multiple vulnerabilities in MATCHA series
type: item
description: MATCHA series provided by ICZ Corporation contains multiple vulnerabilities.
publisher: JVN
date: 2026-04-08T12:00:00+09:00
issued: 2026-04-08T12:00:00+09:00
modified: 2026-04-08T12:00:00+09:00

Multiple vulnerabilities in NEC Aterm series (NV26-001)
type: item
description: Aterm series products provided by NEC Corporation contain multiple vulnerabilities.
publisher: JVN
date: 2026-04-03T12:00:00+09:00
issued: 2026-04-03T12:00:00+09:00
modified: 2026-04-03T12:00:00+09:00

Multiple vulnerabilities in baserCMS
type: item
description: baserCMS provided by baserCMS User Community contains multiple vulnerabilities.
publisher: JVN
date: 2026-03-27T12:00:45+09:00
issued: 2026-03-27T12:00:45+09:00
modified: 2026-03-27T12:00:45+09:00

WordPress Plugin "OpenStreetMap" vulnerable to cross-site scripting
type: item
description: WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-03-27T12:00:30+09:00
issued: 2026-03-27T12:00:30+09:00
modified: 2026-03-27T12:00:30+09:00

Multiple vulnerabilities in BUFFALO Wi-Fi routers
type: item
description: Wi-Fi router products provided by BUFFALO INC. contain multiple vulnerabilities.
publisher: JVN
date: 2026-03-27T12:00:00+09:00
issued: 2026-03-27T12:00:00+09:00
modified: 2026-03-27T12:00:00+09:00

Multiple vulnerabilities in the installer of RATOC RAID Monitoring Manager for Windows
type: item
description: The installer of RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-03-26T12:00:15+09:00
issued: 2026-03-26T12:00:15+09:00
modified: 2026-03-26T12:00:15+09:00

Digital Photo Frame GH-WDF10A vulnerable to improper access restriction
type: item
description: Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an improper access restriction vulnerability.
publisher: JVN
date: 2026-03-26T12:00:00+09:00
issued: 2026-03-26T12:00:00+09:00
modified: 2026-03-26T12:00:00+09:00

SHARP routers missing authentication for some web APIs
type: item
description: SHARP routers allow access to some web APIs without authentication.
publisher: JVN
date: 2026-03-25T14:00:00+09:00
issued: 2026-03-25T14:00:00+09:00
modified: 2026-03-25T14:00:00+09:00

Installer of OM Workspace (Windows Edition) may insecurely load Dynamic Link Libraries
type: item
description: Installer of OM Workspace (Windows Edition) provided by OM Digital Solutions Corporation may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-03-25T12:00:15+09:00
issued: 2026-03-25T12:00:15+09:00
modified: 2026-03-25T12:00:15+09:00

SANYO DENKI SANUPS SOFTWARE registers Windows services with unquoted file paths
type: item
description: SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths.
publisher: JVN
date: 2026-03-25T12:00:00+09:00
issued: 2026-03-25T12:00:00+09:00
modified: 2026-03-25T12:00:00+09:00

Installer for IBM Trusteer Rapport may insecurely load Dynamic Link Libraries
type: item
description: The installer for IBM Trusteer Rapport provided by IBM may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-03-17T12:00:00+09:00
issued: 2026-03-17T12:00:00+09:00
modified: 2026-03-17T12:00:00+09:00

Missing authorization in the OpenAI thread/message API endpoints of GROWI
type: item
description: GROWI provided by GROWI, Inc. contains a missing authorization vulnerability in the OpenAI thread/message API endpoints.
publisher: JVN
date: 2026-03-16T14:00:00+09:00
issued: 2026-03-16T14:00:00+09:00
modified: 2026-03-16T14:00:00+09:00

OpenLiteSpeed and LSWS Enterprise vulnerable to OS command injection
type: item
description: OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.
publisher: JVN
date: 2026-03-16T12:00:00+09:00
issued: 2026-03-16T12:00:00+09:00
modified: 2026-03-16T12:00:00+09:00

Improper file access permission settings in multiple Digital Arts products
type: item
description: Multiple products provided by Digital Arts Inc. are configured with improper file access permission settings.
publisher: JVN
date: 2026-03-09T14:00:00+09:00
issued: 2026-03-09T14:00:00+09:00
modified: 2026-03-09T14:00:00+09:00

Installer for Qsee Client may insecurely load Dynamic Link Libraries
type: item
description: The installer for Qsee Client provided by Qsee may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-03-09T12:00:00+09:00
issued: 2026-03-09T12:00:00+09:00
modified: 2026-03-09T12:00:00+09:00

django-allauth vulnerable to open redirect
type: item
description: django-allauth contains an open redirect vulnerability.
publisher: JVN
date: 2026-03-05T12:00:15+09:00
issued: 2026-03-05T12:00:15+09:00
modified: 2026-03-05T12:00:15+09:00

EC-CUBE vulnerable to multi-factor authentication bypass
type: item
description: EC-CUBE provided by EC-CUBE CO.,LTD. contains a multi-factor authentication (MFA) bypass vulnerability.
publisher: JVN
date: 2026-03-05T12:00:00+09:00
issued: 2026-03-05T12:00:00+09:00
modified: 2026-03-05T12:00:00+09:00

Multiple vulnerabilities in Dell UPS Multi-UPS Management Console (MUMC)
type: item
description: UPS Multi-UPS Management Console (MUMC) provided by Dell Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-03-04T12:00:00+09:00
issued: 2026-03-04T12:00:00+09:00
modified: 2026-03-04T12:00:00+09:00

IM-LogicDesigner module of intra-mart Accel Platform vulnerable to untrusted data deserialization
type: item
description: IM-LogicDesigner module of intra-mart Accel Platform provided by NTT DATA INTRAMART Corporation contains an untrusted data deserialization vulnerability.
publisher: JVN
date: 2026-02-27T15:00:00+09:00
issued: 2026-02-27T15:00:00+09:00
modified: 2026-02-27T15:00:00+09:00

Improper file access permission settings in the installers for multiple Soliton Systems products
type: item
description: The installers for multiple products provided by Soliton Systems K.K. are configured with improper file access permission settings.
publisher: JVN
date: 2026-02-27T14:00:00+09:00
issued: 2026-02-27T14:00:00+09:00
modified: 2026-02-27T14:00:00+09:00

Multiple vulnerabilities in the installer of FinalCode Client
type: item
description: The installer of FinalCode Client provided by Digital Arts Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-02-26T14:00:00+09:00
issued: 2026-02-26T14:00:00+09:00
modified: 2026-02-26T14:00:00+09:00

Lanscope Endpoint Manager (On-Premises) vulnerable to path traversal
type: item
description: Lanscope Endpoint Manager (On-Premises) provided by MOTEX Inc. contains a path traversal vulnerability.
publisher: JVN
date: 2026-02-25T12:00:00+09:00
issued: 2026-02-25T12:00:00+09:00
modified: 2026-02-25T12:00:00+09:00

Installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール may insecurely load Dynamic Link Libraries
type: item
description: The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール provided by Ricoh Company, Ltd. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-02-20T12:00:30+09:00
issued: 2026-02-20T12:00:30+09:00
modified: 2026-02-20T12:00:30+09:00

WordPress Plugin "Survey Maker" vulnerable to cross-site scripting
type: item
description: WordPress Plugin "Survey Maker" provided by Ays Pro contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-02-20T12:00:00+09:00
issued: 2026-02-20T12:00:00+09:00
modified: 2026-02-20T12:00:00+09:00

Joomla! CMS vulnerable to cross-site scripting
type: item
description: Joomla! CMS provided by Joomla! Project contains a cross-site scripting vulnerability.
publisher: JVN
date: 2026-02-17T12:00:00+09:00
issued: 2026-02-17T12:00:00+09:00
modified: 2026-02-17T12:00:00+09:00

FileZen vulnerable to OS command injection
type: item
description: FileZen provided by Soliton Systems K.K. contains an OS command injection vulnerability.
publisher: JVN
date: 2026-02-13T12:00:00+09:00
issued: 2026-02-13T12:00:00+09:00
modified: 2026-02-13T12:00:00+09:00

Installer of M-Audio M-Track Duo HD may insecurely load Dynamic Link Libraries
type: item
description: The installer of M-Track Duo HD provided by M-Audio may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-02-12T12:00:00+09:00
issued: 2026-02-12T12:00:00+09:00
modified: 2026-02-12T12:00:00+09:00

Oki Electric Industry products and OEM products register Windows services with unquoted file paths
type: item
description: Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted file paths.
publisher: JVN
date: 2026-02-09T15:00:00+09:00
issued: 2026-02-09T15:00:00+09:00
modified: 2026-02-09T15:00:00+09:00

web2py vulnerable to open redirect
type: item
description: web2py contains an open redirect vulnerability.
publisher: JVN
date: 2026-02-05T14:00:00+09:00
issued: 2026-02-05T14:00:00+09:00
modified: 2026-02-05T14:00:00+09:00

Multiple vulnerabilities in Movable Type
type: item
description: Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities.
publisher: JVN
date: 2026-02-04T12:00:00+09:00
issued: 2026-02-04T12:00:00+09:00
modified: 2026-02-04T12:00:00+09:00

Multiple vulnerabilities in ELECOM wireless LAN products
type: item
description: Wireless LAN products provided by ELECOM CO.,LTD. contain multiple vulnerabilities.
publisher: JVN
date: 2026-02-03T14:00:00+09:00
issued: 2026-02-03T14:00:00+09:00
modified: 2026-02-03T14:00:00+09:00

Improper file access permission settings in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows
type: item
description: Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows provided by Mitsubishi Electric Corporation is configured with an improper file access permission settings.
publisher: JVN
date: 2026-02-03T12:30:00+09:00
issued: 2026-02-03T12:30:00+09:00
modified: 2026-02-03T12:30:00+09:00

Installer for Roland Cloud Manager may insecurely load Dynamic Link Libraries
type: item
description: The installer for Roland Cloud Manager provided by Roland Corporation may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-02-03T12:00:00+09:00
issued: 2026-02-03T12:00:00+09:00
modified: 2026-02-03T12:00:00+09:00

Multiple vulnerabilities in Cybozu Garoon
type: item
description: Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2026-02-02T12:00:45+09:00
issued: 2026-02-02T12:00:45+09:00
modified: 2026-02-02T12:00:45+09:00

Multiple Microsoft Office products vulnerable to untrusted search path
type: item
description: Multiple Microsoft Office products contain an untrusted search path vulnerability.
publisher: JVN
date: 2026-02-02T12:00:15+09:00
issued: 2026-02-02T12:00:15+09:00
modified: 2026-02-02T12:00:15+09:00

Sonatype Nexus Repository vulnerable to server-side request forgery
type: item
description: Nexus Repository provided by Sonatype is vulnerable to server-side request forgery.
publisher: JVN
date: 2026-02-02T12:00:10+09:00
issued: 2026-02-02T12:00:10+09:00
modified: 2026-02-02T12:00:10+09:00

OS command injection in raspap-webgui
type: item
description: RaspAP raspap-webgui contains an OS command injection vulnerability.
publisher: JVN
date: 2026-02-02T12:00:00+09:00
issued: 2026-02-02T12:00:00+09:00
modified: 2026-02-02T12:00:00+09:00

Undocumented "TelnetEnable" functionality of End of Service NETGEAR products
type: item
description: Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.
publisher: JVN
date: 2026-01-30T12:00:00+09:00
issued: 2026-01-30T12:00:00+09:00
modified: 2026-01-30T12:00:00+09:00

beat-access for Windows may insecurely load Dynamic Link Libraries
type: item
description: beat-access for Windows provided by FUJIFILM Business Innovation Corp. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-01-27T12:00:00+09:00
issued: 2026-01-27T12:00:00+09:00
modified: 2026-01-27T12:00:00+09:00

Command injection vulnerability in ASUS routers
type: item
description: A command injection vulnerability exists in ASUS routers.
publisher: JVN
date: 2026-01-23T12:00:00+09:00
issued: 2026-01-23T12:00:00+09:00
modified: 2026-01-23T12:00:00+09:00

Installer of Fujitsu ServerView Agents for Windows may insecurely load Dynamic Link Libraries
type: item
description: The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-01-21T14:00:00+09:00
issued: 2026-01-21T14:00:00+09:00
modified: 2026-01-21T14:00:00+09:00

Ruijie Networks AP180 series vulnerable to OS command injection
type: item
description: AP180 series provided by Ruijie Networks Co., Ltd. contains an OS command injection vulnerability.
publisher: JVN
date: 2026-01-21T12:00:00+09:00
issued: 2026-01-21T12:00:00+09:00
modified: 2026-01-21T12:00:00+09:00

Multiple Vulnerabilities in TOA Network Cameras TRIFORA 3 series
type: item
description: Network Cameras TRIFORA 3 series provided by TOA Corporation contain multiple vulnerabilities.
publisher: JVN
date: 2026-01-16T12:00:00+09:00
issued: 2026-01-16T12:00:00+09:00
modified: 2026-01-16T12:00:00+09:00

Chainlit vulnerable to improper access restriction
type: item
description: Chainlit provided by Chainlit contains an improper access restriction vulnerability.
publisher: JVN
date: 2026-01-14T12:00:00+09:00
issued: 2026-01-14T12:00:00+09:00
modified: 2026-01-14T12:00:00+09:00

Multiple vulnerabilities in EATON UPS Companion
type: item
description: EATON UPS Companion provided by Eaton contains multiple vulnerabilities.
publisher: JVN
date: 2026-01-13T12:00:00+09:00
issued: 2026-01-13T12:00:00+09:00
modified: 2026-01-13T12:00:00+09:00

RICOH Streamline NX vulnerable to improper authorization
type: item
description: RICOH Streamline NX provided by Ricoh Company, Ltd. contains an improper authorization vulnerability.
publisher: JVN
date: 2026-01-09T14:00:00+09:00
issued: 2026-01-09T14:00:00+09:00
modified: 2026-01-09T14:00:00+09:00

The installers for multiple PIONEER products may insecurely load Dynamic Link Libraries
type: item
description: The installers for multiple products provided by PIONEER CORPORATION may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2026-01-08T12:00:00+09:00
issued: 2026-01-08T12:00:00+09:00
modified: 2026-01-08T12:00:00+09:00

Multiple vulnerabilities in multiple NEC branded projectors manufactured by Sharp Display Solutions, Ltd.
type: item
description: Multiple NEC branded projectors manufactured by Sharp Display Solutions, Ltd. contain multiple vulnerabilities.
publisher: JVN
date: 2026-01-07T12:00:15+09:00
issued: 2026-01-07T12:00:15+09:00
modified: 2026-01-07T12:00:15+09:00

Origin validation error vulnerability in Fujitsu Security Solution AuthConductor Client Basic V2
type: item
description: Fujitsu Security Solution AuthConductor Client Basic V2 provided by Fujitsu Client Computing Limited contains an origin validation error vulnerability.
publisher: JVN
date: 2026-01-07T12:00:00+09:00
issued: 2026-01-07T12:00:00+09:00
modified: 2026-01-07T12:00:00+09:00

GROWI vulnerable to cross-site request forgery
type: item
description: GROWI provided by GROWI, Inc. contains a cross-site request forgery vulnerability.
publisher: JVN
date: 2025-12-17T12:00:00+09:00
issued: 2025-12-17T12:00:00+09:00
modified: 2025-12-17T12:00:00+09:00

SEIKO EPSON printer Web Config vulnerable to stack-based buffer overflow
type: item
description: SEIKO EPSON printer Web Config contains a stack-based buffer overflow vulnerability.
publisher: JVN
date: 2025-12-16T14:00:00+09:00
issued: 2025-12-16T14:00:00+09:00
modified: 2025-12-16T14:00:00+09:00

QND vulnerable to privilege escalation
type: item
description: QND provided by QualitySoft Corporation is vulnerable to privilege escalation.
publisher: JVN
date: 2025-12-11T12:00:00+09:00
issued: 2025-12-11T12:00:00+09:00
modified: 2025-12-11T12:00:00+09:00

ELECOM Clone for Windows registers a Windows service with an unquoted file path
type: item
description: Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path.
publisher: JVN
date: 2025-12-09T14:00:00+09:00
issued: 2025-12-09T14:00:00+09:00
modified: 2025-12-09T14:00:00+09:00

Multiple vulnerabilities in GroupSession
type: item
description: GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities.
publisher: JVN
date: 2025-12-08T14:00:00+09:00
issued: 2025-12-08T14:00:00+09:00
modified: 2025-12-08T14:00:00+09:00

GS Yuasa FULLBACK Manager Pro registers Windows services with unquoted file paths
type: item
description: FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths.
publisher: JVN
date: 2025-12-08T12:00:00+09:00
issued: 2025-12-08T12:00:00+09:00
modified: 2025-12-08T12:00:00+09:00

Multiple vulnerabilities in ABB Terra AC Wallbox
type: item
description: Terra AC Wallbox provided by ABB contains multiple vulnerabilities.
publisher: JVN
date: 2025-12-05T12:00:00+09:00
issued: 2025-12-05T12:00:00+09:00
modified: 2025-12-05T12:00:00+09:00

Installer of INZONE Hub may insecurely load Dynamic Link Libraries
type: item
description: The installer of INZONE Hub provided by Sony Corporation may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2025-11-28T12:00:00+09:00
issued: 2025-11-28T12:00:00+09:00
modified: 2025-11-28T12:00:00+09:00

SwitchBot Smart Video Doorbell vulnerable to active debug code
type: item
description: Smart Video Doorbell provided by SwitchBot is vulnerable to active debug code.
publisher: JVN
date: 2025-11-26T12:00:00+09:00
issued: 2025-11-26T12:00:00+09:00
modified: 2025-11-26T12:00:00+09:00

Multiple vulnerabilities in Security Point (Windows) of MaLion
type: item
description: Security Point (Windows) of MaLion provided by Intercom, Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2025-11-25T14:00:00+09:00
issued: 2025-11-25T14:00:00+09:00
modified: 2025-11-25T14:00:00+09:00

Multiple vulnerabilities in SNC-CX600W
type: item
description: SNC-CX600W provided by Sony Corporation contains multiple vulnerabilities.
publisher: JVN
date: 2025-11-25T12:00:15+09:00
issued: 2025-11-25T12:00:15+09:00
modified: 2025-11-25T12:00:15+09:00

"FOD" App uses hard-coded cryptographic keys
type: item
description: "FOD" App provided by Fuji Television Network, Inc. uses hard-coded cryptographic keys.
publisher: JVN
date: 2025-11-25T12:00:00+09:00
issued: 2025-11-25T12:00:00+09:00
modified: 2025-11-25T12:00:00+09:00

Multiple vulnerabilities in LogStare Collector
type: item
description: LogStare Collector provided by LogStare Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2025-11-21T12:00:00+09:00
issued: 2025-11-21T12:00:00+09:00
modified: 2025-11-21T12:00:00+09:00

Installer of RakurakuMusen Start EX for Windows may insecurely load Dynamic Link Libraries
type: item
description: Installer of RakurakuMusen Start EX for Windows provided by NEC Corporation may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2025-11-19T12:00:00+09:00
issued: 2025-11-19T12:00:00+09:00
modified: 2025-11-19T12:00:00+09:00

"デジラアプリ" App for iOS vulnerable to improper server certificate verification
type: item
description: "デジラアプリ" App for iOS provided by KDDI CORPORATION is vulnerable to improper server certificate verification.
publisher: JVN
date: 2025-11-17T12:00:00+09:00
issued: 2025-11-17T12:00:00+09:00
modified: 2025-11-17T12:00:00+09:00

NCP-HG100 vulnerable to OS command injection
type: item
description: NCP-HG100 provided by Sony Network Communications Inc. and used in MANOMA service contains an OS command injection vulnerability.
publisher: JVN
date: 2025-11-14T14:00:00+09:00
issued: 2025-11-14T14:00:00+09:00
modified: 2025-11-14T14:00:00+09:00

Multiple vulnerabilities in GNU Libmicrohttpd
type: item
description: GNU Libmicrohttpd provided by GNU Project contains multiple vulnerabilities.
publisher: JVN
date: 2025-11-10T12:00:00+09:00
issued: 2025-11-10T12:00:00+09:00
modified: 2025-11-10T12:00:00+09:00

Use of password hash with insufficient computational effort vulnerability in BUFFALO Wi-Fi router "WSR-1800AX4 series"
type: item
description: Wi-Fi router "WSR-1800AX4 series" provided by BUFFALO INC. contains a use of password hash with insufficient computational effort vulnerability.
publisher: JVN
date: 2025-11-07T14:00:00+09:00
issued: 2025-11-07T14:00:00+09:00
modified: 2025-11-07T14:00:00+09:00

CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to OS command injection
type: item
description: CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain an OS command injection vulnerability.
publisher: JVN
date: 2025-11-07T12:00:00+09:00
issued: 2025-11-07T12:00:00+09:00
modified: 2025-11-07T12:00:00+09:00

GROWI vulnerable to stored cross-site scripting
type: item
description: GROWI provided by GROWI, Inc. contains a stored cross-site scripting vulnerability.
publisher: JVN
date: 2025-11-06T12:00:00+09:00
issued: 2025-11-06T12:00:00+09:00
modified: 2025-11-06T12:00:00+09:00

Multiple Roboticsware products register Windows services with unquoted file paths
type: item
description: Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths.
publisher: JVN
date: 2025-11-04T12:00:30+09:00
issued: 2025-11-04T12:00:30+09:00
modified: 2025-11-04T12:00:30+09:00

Optical Disc Archive Software (for Windows) registers a Windows service with an unquoted file path
type: item
description: Optical Disc Archive Software (for Windows) provided by Sony Corporation registers a Windows service with an unquoted file path.
publisher: JVN
date: 2025-11-04T12:00:15+09:00
issued: 2025-11-04T12:00:15+09:00
modified: 2025-11-04T12:00:15+09:00

Progress Flowmon vulnerable to authenticated OS command injection
type: item
description: Progress Flowmon provided by Progress Software Corporation contains an authenticated OS command injection vulnerability.
publisher: JVN
date: 2025-11-04T12:00:00+09:00
issued: 2025-11-04T12:00:00+09:00
modified: 2025-11-04T12:00:00+09:00

Installer of WTW EAGLE (for Windows) may insecurely load Dynamic Link Libraries
type: item
description: The installer of WTW EAGLE (for Windows) provided by Wireless Tsukamoto Co., Ltd. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2025-10-29T12:00:00+09:00
issued: 2025-10-29T12:00:00+09:00
modified: 2025-10-29T12:00:00+09:00

MZK-DP300N uses hard-coded credentials
type: item
description: MZK-DP300N provided by PLANEX COMMUNICATIONS INC. uses hard-coded credentials.
publisher: JVN
date: 2025-10-28T12:00:00+09:00
issued: 2025-10-28T12:00:00+09:00
modified: 2025-10-28T12:00:00+09:00

Multiple stored cross-site scripting vulnerabilities in Pleasanter
type: item
description: Pleasanter provided by Implem Inc. contains multiple stored cross-site scripting vulnerabilities.
publisher: JVN
date: 2025-10-24T14:00:00+09:00
issued: 2025-10-24T14:00:00+09:00
modified: 2025-10-24T14:00:00+09:00

GROWI vulnerable to cross-site scripting
type: item
description: GROWI provided by GROWI, Inc. contains a cross-site scripting vulnerability.
publisher: JVN
date: 2025-10-22T15:00:00+09:00
issued: 2025-10-22T15:00:00+09:00
modified: 2025-10-22T15:00:00+09:00

Multiple I-O DATA NAS management applications register Windows services with unquoted file paths
type: item
description: Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths.
publisher: JVN
date: 2025-10-22T14:00:00+09:00
issued: 2025-10-22T14:00:00+09:00
modified: 2025-10-22T14:00:00+09:00

Multiple stored cross-site scripting vulnerabilities in Movable Type
type: item
description: Movable Type provided by Six Apart Ltd. contains multiple stored cross-site scripting vulnerabilities.
publisher: JVN
date: 2025-10-22T12:00:00+09:00
issued: 2025-10-22T12:00:00+09:00
modified: 2025-10-22T12:00:00+09:00

Lanscope Endpoint Manager (On-Premises) vulnerable to improper verification of source of a communication channel
type: item
description: Lanscope Endpoint Manager (On-Premises) provided by MOTEX Inc. contains a vulnreability that leads to arbitrary code execution due to improper verification of source of a communication channel (CWE-940).
publisher: JVN
date: 2025-10-20T14:00:00+09:00
issued: 2025-10-20T14:00:00+09:00
modified: 2025-10-20T14:00:00+09:00

ETERNUS SF vulnerable to incorrect default permissions
type: item
description: ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability.
publisher: JVN
date: 2025-10-20T12:00:00+09:00
issued: 2025-10-20T12:00:00+09:00
modified: 2025-10-20T12:00:00+09:00

Installer of AutoDownloader may insecurely load Dynamic Link Libraries
type: item
description: Installer of AutoDownloader provided by Panasonic Connect Co., Ltd. may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2025-10-17T12:00:00+09:00
issued: 2025-10-17T12:00:00+09:00
modified: 2025-10-17T12:00:00+09:00

Multiple vulnerabilities in ChatLuck
type: item
description: ChatLuck provided by NEOJAPAN Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2025-10-16T14:00:15+09:00
issued: 2025-10-16T14:00:15+09:00
modified: 2025-10-16T14:00:15+09:00

Multiple vulnerabilities in desknet's NEO
type: item
description: desknet's NEO provided by NEOJAPAN Inc. contains multiple vulnerabilities.
publisher: JVN
date: 2025-10-16T14:00:00+09:00
issued: 2025-10-16T14:00:00+09:00
modified: 2025-10-16T14:00:00+09:00

Ruijie Networks RG-EST300 undocumented SSH functionality
type: item
description: RG-EST300 provided by Ruijie Networks provides undocumented SSH server functionality, which is enabled in the initial configuration.
publisher: JVN
date: 2025-10-16T12:00:00+09:00
issued: 2025-10-16T12:00:00+09:00
modified: 2025-10-16T12:00:00+09:00

Phoenix Contact CHARX SEC-3xxx vulnerable to code injection
type: item
description: CHARX SEC-3xxx provided by Phoenix Contact contains a code injection vulnerability.
publisher: JVN
date: 2025-10-15T14:00:00+09:00
issued: 2025-10-15T14:00:00+09:00
modified: 2025-10-15T14:00:00+09:00

Multiple RSUPPORT products may insecurely load Dynamic Link Libraries
type: item
description: Multiple RSUPPORT products may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2025-10-15T12:00:00+09:00
issued: 2025-10-15T12:00:00+09:00
modified: 2025-10-15T12:00:00+09:00

BUFFALO NAS Navigator2 registers a Windows service with an unquoted file path
type: item
description: NAS Navigator2 provided by BUFFALO INC. registers a Windows service with an unquoted file path.
publisher: JVN
date: 2025-10-10T12:00:00+09:00
issued: 2025-10-10T12:00:00+09:00
modified: 2025-10-10T12:00:00+09:00

The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries
type: item
description: The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries.
publisher: JVN
date: 2025-10-06T14:00:00+09:00
issued: 2025-10-06T14:00:00+09:00
modified: 2025-10-06T14:00:00+09:00

DataSpider Servista improper restriction of XML external entity references
type: item
description: DataSpider Servista provided by Saison Technology Co.,Ltd. improperly restricts XML external entity references.
publisher: JVN
date: 2025-09-29T12:00:00+09:00
issued: 2025-09-29T12:00:00+09:00
modified: 2025-09-29T12:00:00+09:00

UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation vulnerable to cross-site scripting
type: item
description: UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contains a cross-site scripting vulnerability.
publisher: JVN
date: 2025-09-18T12:00:00+09:00
issued: 2025-09-18T12:00:00+09:00
modified: 2025-09-18T12:00:00+09:00

Century HW RAID Manager registers a Windows service with an unquoted file path
type: item
description: RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path.
publisher: JVN
date: 2025-09-17T12:00:00+09:00
issued: 2025-09-17T12:00:00+09:00
modified: 2025-09-17T12:00:00+09:00

WTW-EAGLE App vulnerable to improper server certificate validation
type: item
description: WTW-EAGLE App provided by Wireless Tsukamoto Co., Ltd. is vulnerable to improper server certificate validation.
publisher: JVN
date: 2025-09-12T12:00:00+09:00
issued: 2025-09-12T12:00:00+09:00
modified: 2025-09-12T12:00:00+09:00

RICOH Streamline NX vulnerable to tampering with operation history
type: item
description: RICOH Streamline NX provided by Ricoh Company, Ltd. contains a vulnerability that may lead to tampering with operation history
publisher: JVN
date: 2025-09-08T12:00:00+09:00
issued: 2025-09-08T12:00:00+09:00
modified: 2025-09-08T12:00:00+09:00

RATOC RAID Monitoring Manager for Windows registers a Windows service with an unquoted file path
type: item
description: RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path.
publisher: JVN
date: 2025-09-05T12:00:45+09:00
issued: 2025-09-05T12:00:45+09:00
modified: 2025-09-05T12:00:45+09:00

Obsidian GitHub Copilot Plugin stores sensitive information in cleartext
type: item
description: Obsidian GitHub Copilot Plugin provided by Pierre-Adrien Vasseur stores sensitive information in cleartext.
publisher: JVN
date: 2025-09-05T12:00:30+09:00
issued: 2025-09-05T12:00:30+09:00
modified: 2025-09-05T12:00:30+09:00

"Yahoo! Shopping" App for Android fails to restrict custom URL schemes properly
type: item
description: "Yahoo! Shopping" App for Android provided by LY Corporation fails to restrict custom URL schemes properly.
publisher: JVN
date: 2025-09-05T12:00:15+09:00
issued: 2025-09-05T12:00:15+09:00
modified: 2025-09-05T12:00:15+09:00

Multiple vulnerabilities in TkEasyGUI
type: item
description: TkEasyGUI provided by kujirahand contains multiple vulnerabilities.
publisher: JVN
date: 2025-09-05T12:00:00+09:00
issued: 2025-09-05T12:00:00+09:00
modified: 2025-09-05T12:00:00+09:00

Web Caster V130 vulnerable to cross-site request forgery
type: item
description: Web Caster V130 provided by NTT EAST, Inc. and NTT WEST, Inc. contains a cross-site request forgery vulnerability.
publisher: JVN
date: 2025-09-03T12:00:00+09:00
issued: 2025-09-03T12:00:00+09:00
modified: 2025-09-03T12:00:00+09:00

"Gunosy" App vulnerable to insertion of sensitive information into sent data (CWE-201)
type: item
description: "Gunosy" App provided by Gunosy Inc. contains a vulnerability where sensitive information may be included in the application's outbound communication.
publisher: JVN
date: 2025-09-02T12:00:00+09:00
issued: 2025-09-02T12:00:00+09:00
modified: 2025-09-02T12:00:00+09:00