Vulnerability Search Top
Show Search Menu
Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

  • Urgent
  • Important
  • Warning
  • Low
JVN Vulnerability Information

Update Date":May 11, 2026, 6:01 p.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Impact
Show		 Exploit
PoC
Search
2271 8.8 重要
Network 		OpenMage Magento OpenMageのMagentoにおける危険なタイプのファイルの無制限アップロードに関する脆弱性 CWE-434
危険なタイプのファイルの無制限アップロード 		CVE-2026-40488 2026-04-27 11:21 2026-04-20 Show GitHub Exploit DB Packet Storm
2272 9.1 緊急
Network 		FreeScout FreeScout FreeScoutにおける複数の脆弱性 CWE-330
CWE-340
CVE-2026-40496 2026-04-27 11:21 2026-04-21 Show GitHub Exploit DB Packet Storm
2273 8.1 重要
Network 		FreeScout FreeScout FreeScoutにおけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2026-40497 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2274 8.8 重要
Network 		PJSIP pjsip PJSIPのpjsipにおけるヒープベースのバッファオーバーフローの脆弱性 CWE-122
ヒープオーバーフロー 		CVE-2026-40614 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2275 6.5 警告
Network 		decidim decidim Decidim Free Software AssociationのDecidimにおける不適切な権限設定に関する脆弱性 CWE-266
不適切な権限設定 		CVE-2026-40869 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2276 9.8 緊急
Network 		PJSIP pjsip PJSIPのpjsipにおけるスタックベースのバッファオーバーフローの脆弱性 CWE-121
スタックオーバーフロー 		CVE-2026-40892 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2277 7.5 重要
Network 		follow-redirects project Follow Redirects Follow Redirects projectのFollow Redirectsにおける情報漏えいに関する脆弱性 CWE-200
CWE-noinfo
CVE-2026-40895 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2278 6.5 警告
Network 		WWBN AVideo WWBNのAVideoにおけるユーザ制御の鍵による認証回避に関する脆弱性 CWE-639
ユーザ制御の鍵による認証回避 		CVE-2026-40907 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2279 5.3 警告
Network 		WWBN AVideo WWBNのAVideoにおける情報漏えいに関する脆弱性 CWE-200
情報漏えい 		CVE-2026-40908 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
2280 6.5 警告
Network 		WWBN AVideo WWBNのAVideoにおけるパストラバーサルの脆弱性 CWE-22
パス・トラバーサル 		CVE-2026-40909 2026-04-27 11:20 2026-04-21 Show GitHub Exploit DB Packet Storm
NVD Vulnerability Information

Update Date:May 12, 2026, 5:06 a.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Show Affected Exploit
PoC
Search
314331 - - - The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such action via a CSRF attack - CVE-2024-6496 2024-08-7 23:35 2024-08-1 Show GitHub Exploit DB Packet Storm
314332 - - - ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects the function soapcgi_main of the file /soap.cgi. The manipula… CWE-78
OS Command  		CVE-2024-7357 2024-08-7 23:15 2024-08-1 Show GitHub Exploit DB Packet Storm
314333 - - - Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTM… - CVE-2024-7000 2024-08-7 22:35 2024-08-7 Show GitHub Exploit DB Packet Storm
314334 - typo3 typo3 SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter. NOTE: the TYPO3 Security Team disputes this report, stating … CWE-89
SQL Injection 		CVE-2009-4855 2024-08-7 17:16 2010-05-11 Show GitHub Exploit DB Packet Storm
314335 - - - The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS)… - CVE-2024-6494 2024-08-7 15:16 2024-08-7 Show GitHub Exploit DB Packet Storm
314336 - - - The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used aga… - CVE-2024-3973 2024-08-7 15:16 2024-08-7 Show GitHub Exploit DB Packet Storm
314337 - varnish.projects.linpro varnish The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received… CWE-287
Improper Authentication 		CVE-2009-2936 2024-08-7 15:16 2010-04-6 Show GitHub Exploit DB Packet Storm
314338 - - - Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerabil… - CVE-2024-37403 2024-08-7 13:17 2024-08-7 Show GitHub Exploit DB Packet Storm
314339 - - - Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources. - CVE-2024-36132 2024-08-7 13:17 2024-08-7 Show GitHub Exploit DB Packet Storm
314340 - - - An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sensitive information - CVE-2024-34788 2024-08-7 13:17 2024-08-7 Show GitHub Exploit DB Packet Storm