Vulnerability Search Top

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

Urgent
Important
Warning
Low

JVN Vulnerability Information

Update Date":May 13, 2026, 6 p.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Impact Show	Exploit PoC Search
2981	5.9	警告 Network	VMware	Spring Framework	VMwareのSpring Frameworkにおけるパストラバーサルの脆弱性	CWE-22 パス・トラバーサル	CVE-2026-22737	2026-04-24 11:33	2026-03-20	Show	GitHub Exploit DB Packet Storm

2982	7.2	重要 Network	デル	PowerProtect DP Series Appliance data domain operating system	デルのdata domain operating system等の複数製品におけるOS コマンドインジェクションの脆弱性	CWE-78 OSコマンド・インジェクション	CVE-2026-23774	2026-04-24 11:33	2026-04-20	Show	GitHub Exploit DB Packet Storm

2983	8.7	重要 Network	decidim	decidim	Decidim Free Software AssociationのDecidimにおけるクロスサイトスクリプティングの脆弱性	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2026-23891	2026-04-24 11:33	2026-04-13	Show	GitHub Exploit DB Packet Storm

2984	4.9	警告 Network	OctoberCMS	October	OctoberCMSのOctoberにおける複数の脆弱性	CWE-200 CWE-94	CVE-2026-25125	2026-04-24 11:33	2026-04-14	Show	GitHub Exploit DB Packet Storm

2985	6.7	警告 Network	フォーティネット	FortiSandbox FortiSandbox Cloud	フォーティネットのFortiSandbox等の複数製品におけるパストラバーサルの脆弱性	CWE-22 パス・トラバーサル	CVE-2026-25691	2026-04-24 11:33	2026-04-14	Show	GitHub Exploit DB Packet Storm

2986	6.1	警告 Local	Zulip	Zulip	Zulipにおけるパストラバーサルの脆弱性	CWE-22 パス・トラバーサル	CVE-2026-26058	2026-04-24 11:33	2026-04-3	Show	GitHub Exploit DB Packet Storm

2987	8.8	重要 Network	デル	PowerProtect DP Series Appliance data domain operating system	デルのdata domain operating system等の複数製品における重要な機能に対する認証の欠如に関する脆弱性	CWE-306 重要な機能に対する認証の欠如解説	CVE-2026-26944	2026-04-24 11:33	2026-04-20	Show	GitHub Exploit DB Packet Storm

2988	6.1	警告 Network	Jeremiah Lowin	FastMCP	Jeremiah LowinのFastMCPにおけるフィルタリングの回避に関する脆弱性	CWE-441 フィルタリング回避	CVE-2026-27124	2026-04-24 11:33	2026-04-3	Show	GitHub Exploit DB Packet Storm

2989	2.7	低 Network	フォーティネット	FortiSandbox FortiSandbox Cloud	フォーティネットのFortiSandbox等の複数製品における認証情報の不十分な保護に関する脆弱性	CWE-522 認証情報の不十分な保護	CVE-2026-27316	2026-04-24 11:33	2026-04-14	Show	GitHub Exploit DB Packet Storm

2990	6.3	警告 Network	OpenPrinting	CUPS	OpenPrintingのCUPSにおける不正な認証に関する脆弱性	CWE-863 不正な認証	CVE-2026-27447	2026-04-24 11:32	2026-04-3	Show	GitHub Exploit DB Packet Storm

NVD Vulnerability Information

Update Date:May 14, 2026, 4 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
91	8.8	HIGH Network	-	-	Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. New	CWE-78 CWE-384 OS Command Session Fixation	CVE-2026-41613	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

92	5.5	MEDIUM Local	-	-	Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally. New	CWE-22 CWE-23 Path Traversal Relative Path Traversal	CVE-2026-41612	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

93	7.8	HIGH Local	-	-	Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. New	CWE-77 CWE-80 Command Injection Basic XSS	CVE-2026-41611	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

94	6.3	MEDIUM Local	-	-	Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. New	CWE-59 CWE-79 CWE-200 Link Following Cross-site Scripting Information Exposure	CVE-2026-41610	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

95	-		-	-	Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted app… New	CWE-601 Open Redirect	CVE-2026-41513	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

96	-		-	-	Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0… New	CWE-20 Improper Input Validation	CVE-2026-41293	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

97	-		-	-	Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 t… New	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2026-41284	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

98	5.7	MEDIUM Network	-	-	Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stored XSS. This vulnerability is fixed in 6.9.1. New	CWE-79 Cross-site Scripting	CVE-2026-41250	2026-05-13 03:17	2026-05-12	Show	GitHub Exploit DB Packet Storm

99	8.8	HIGH Network	-	-	Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature ove… New	CWE-74 Injection	CVE-2026-41109	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

100	7.4	HIGH Network	-	-	External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. New	CWE-73 External Control of File Name or Path	CVE-2026-41107	2026-05-13 03:17	2026-05-13	Show	GitHub Exploit DB Packet Storm

Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed