Vulnerability Search Top

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

Urgent
Important
Warning
Low

JVN Vulnerability Information

Update Date":May 4, 2026, 6 p.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Impact Show	Exploit PoC Search
2121	9.8	緊急 Network	ThemeMove	UniCamp	ThemeMoveのWordPress用UniCampにおけるPHP リモートファイルインクルージョンの脆弱性	CWE-98 PHP リモートファイルインクルージョン	CVE-2025-54701	2026-02-6 10:40	2025-08-14	Show	GitHub Exploit DB Packet Storm

2122	5.3	警告 Network	Codeshare	Codeshare	Codeshareにおける情報漏えいに関する脆弱性	CWE-200 情報漏えい	CVE-2025-60925	2026-02-6 10:40	2025-11-4	Show	GitHub Exploit DB Packet Storm

2123	6.1	警告 Network	Zucchetti s.p.a.	Infinity Zucchetti ZMaintenance Infinity	Zucchetti s.p.a.のZMaintenance Infinity等の複数製品におけるクロスサイトスクリプティングの脆弱性	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2025-61431	2026-02-6 10:40	2025-11-4	Show	GitHub Exploit DB Packet Storm

2124	9.1	緊急 Network	Shopify	remix-run/deno @remix-run/node @react-router/node	Shopifyの@react-router/node等の複数製品におけるパストラバーサルの脆弱性	CWE-22 パス・トラバーサル	CVE-2025-61686	2026-02-6 10:40	2026-01-10	Show	GitHub Exploit DB Packet Storm

2125	9.8	緊急 Network	EUROLAB srl	ELTS 100 Firmware	EUROLAB srlのELTS 100 Firmwareにおけるアクセス制御に関する脆弱性	CWE-284 不適切なアクセス制御	CVE-2025-63225	2026-02-6 10:40	2025-11-18	Show	GitHub Exploit DB Packet Storm

2126	3.5	低 Adjacent	Freebox	Freebox One Firmware Freebox v5 HD Firmware Freebox v5 Crystal Firmware Freebox v6 Revolution Firmware Freebox Mini 4K&nbs…	FreeboxのFreebox Mini 4K Firmware等の複数製品における重要な情報の平文での送信に関する脆弱性	CWE-319 重要な情報の平文での送信	CVE-2025-63292	2026-02-6 10:40	2025-11-17	Show	GitHub Exploit DB Packet Storm

2127	6.5	警告 Network	workdo	HRM SaaS	WorkDoのHRM SaaSにおける認証の欠如に関する脆弱性	CWE-862 認証の欠如	CVE-2025-63294	2026-02-6 10:40	2025-11-4	Show	GitHub Exploit DB Packet Storm

2128	7.5	重要 Network	kiloview	E3 Firmware	Kiloview Electronics Co., Ltd.のE3 Firmwareにおけるリソースの枯渇に関する脆弱性	CWE-400 リソースの枯渇	CVE-2025-63560	2026-02-6 10:40	2025-11-6	Show	GitHub Exploit DB Packet Storm

2129	6.5	警告 Network	GuoMinJim	PersonManage	GuoMinJimのPersonManageにおけるアクセス制御に関する脆弱性	CWE-284 不適切なアクセス制御	CVE-2025-63686	2026-02-6 10:40	2025-11-7	Show	GitHub Exploit DB Packet Storm

2130	5.4	警告 Network	Magento, Inc.	E-Commerce	Bhabishya-123のE-commerceにおけるクロスサイトスクリプティングの脆弱性	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2025-63883	2026-02-6 10:40	2025-11-18	Show	GitHub Exploit DB Packet Storm

NVD Vulnerability Information

Update Date:May 5, 2026, 4:51 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
1	5.5	MEDIUM Local	absolute	secure_access	CVE-2026-40951 is a memory corruption vulnerability on Secure Access Windows clients prior to 14.50. Attackers with local control of the Windows client can send malformed data to an API and trigger… New	CWE-400 Uncontrolled Resource Consumption	CVE-2026-40951	2026-05-5 03:54	2026-05-1	Show	GitHub Exploit DB Packet Storm

2	9.8	CRITICAL Network	tenda	w308r_firmware	Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send… Update	CWE-290 Authentication Bypass by Spoofing	CVE-2018-25316	2026-05-5 03:42	2026-04-30	Show	GitHub Exploit DB Packet Storm

3	9.8	CRITICAL Network	tenda	fh303_firmware a300_firmware	Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers ca… Update	CWE-290 Authentication Bypass by Spoofing	CVE-2018-25318	2026-05-5 03:40	2026-04-30	Show	GitHub Exploit DB Packet Storm

4	5.0	MEDIUM Network	cloudfoundry	cf-deployment routing_release	Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a malicious developer with access to Cloudfoundry could configure… New	CWE-923 Improper Restriction of Communication Channel to Intended Endpoints	CVE-2026-22726	2026-05-5 03:30	2026-05-1	Show	GitHub Exploit DB Packet Storm

5	7.5	HIGH Network	openstack	ironic_python_agent	An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading … New	CWE-829 Inclusion of Functionality from Untrusted Control Sphere	CVE-2026-43003	2026-05-5 03:28	2026-05-1	Show	GitHub Exploit DB Packet Storm

6	9.8	CRITICAL Network	linux	linux_kernel	In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a clon… New	CWE-787 Out-of-bounds Write	CVE-2026-43037	2026-05-5 03:26	2026-05-2	Show	GitHub Exploit DB Packet Storm

7	8.5	HIGH Network	openstack	keystone	An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authentica… New	CWE-863 Incorrect Authorization	CVE-2026-43001	2026-05-5 03:25	2026-05-1	Show	GitHub Exploit DB Packet Storm

8	7.8	HIGH Local	zhinst	labone_q	The LabOne Q serialization framework uses a class-loading mechanism (import_cls) to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted… New	CWE-502 Deserialization of Untrusted Data	CVE-2026-7584	2026-05-5 03:23	2026-05-1	Show	GitHub Exploit DB Packet Storm

9	9.8	CRITICAL Network	bitwarden	cli	Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident. New	CWE-78 CWE-94 OS Command Code Injection	CVE-2026-42994	2026-05-5 03:23	2026-05-1	Show	GitHub Exploit DB Packet Storm

10	6.5	MEDIUM Network	apple	container	Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3. New	CWE-522 Insufficiently Protected Credentials	CVE-2026-28909	2026-05-5 03:22	2026-05-1	Show	GitHub Exploit DB Packet Storm

Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed