Vulnerability Search Top

Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed

Vulnerability Information Search Top

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

Urgent
Important
Warning
Low

JVN Vulnerability Information

Update Date":May 18, 2026, 6 p.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Impact Show	Exploit PoC Search
401	8.1	重要 Network	Linux	Linux Kernel	LinuxのLinux Kernelにおける不特定の脆弱性 New	CWE-noinfo 情報不足	CVE-2026-43377	2026-05-18 11:26	2026-05-8	Show	GitHub Exploit DB Packet Storm

402	9.8	緊急 Network	Apache Software Foundation	Apache Tomcat	Apache Software FoundationのApache Tomcatにおける認証回避に関する脆弱性 New	CWE-592 認証回避の問題	CVE-2026-43512	2026-05-18 11:26	2026-05-12	Show	GitHub Exploit DB Packet Storm

403	7.5	重要 Network	Apache Software Foundation	Apache Tomcat	Apache Software FoundationのApache Tomcatにおける大文字と小文字の区別の不適切な処理に関する脆弱性 New	CWE-178 大文字と小文字の区別の不適切な処理	CVE-2026-43513	2026-05-18 11:25	2026-05-12	Show	GitHub Exploit DB Packet Storm

404	9.1	緊急 Network	Apache Software Foundation	Apache Tomcat	Apache Software FoundationのApache Tomcatにおける認可に関する脆弱性 New	CWE-285 不適切な認可	CVE-2026-43515	2026-05-18 11:25	2026-05-12	Show	GitHub Exploit DB Packet Storm

405	7.5	重要 Network	Web Technologies	Change Detection	Web TechnologiesのChange Detectionにおけるファイル名やパス名の外部制御に関する脆弱性 New	CWE-73 ファイル名やパス名の外部制御	CVE-2026-43891	2026-05-18 11:25	2026-05-12	Show	GitHub Exploit DB Packet Storm

406	8.7	重要 Network	Daniel Garcia	Vaultwarden	Daniel GarciaのVaultwardenにおける認可に関する脆弱性 New	CWE-285 不適切な認可	CVE-2026-43912	2026-05-18 11:25	2026-05-11	Show	GitHub Exploit DB Packet Storm

407	9.1	緊急 Network	OPNsense project	OPNsense	OPNsenseにおける引数の挿入または変更に関する脆弱性 New	CWE-88 引数の挿入または変更	CVE-2026-44193	2026-05-18 11:25	2026-05-13	Show	GitHub Exploit DB Packet Storm

408	9.1	緊急 Network	OPNsense project	OPNsense	OPNsenseにおけるOS コマンドインジェクションの脆弱性 New	CWE-78 OSコマンド・インジェクション	CVE-2026-44194	2026-05-18 11:25	2026-05-13	Show	GitHub Exploit DB Packet Storm

409	6.5	警告 Network	OPNsense project	OPNsense	OPNsenseにおける過度な認証試行の不適切な制限に関する脆弱性 New	CWE-307 過度な認証試行の不適切な制限	CVE-2026-44195	2026-05-18 11:25	2026-05-13	Show	GitHub Exploit DB Packet Storm

410	9.8	緊急 Network	フォーティネット	FortiAuthenticator	フォーティネットのFortiAuthenticatorにおけるアクセス制御に関する脆弱性 New	CWE-284 不適切なアクセス制御	CVE-2026-44277	2026-05-18 11:25	2026-05-12	Show	GitHub Exploit DB Packet Storm

NVD Vulnerability Information

Update Date:May 19, 2026, 4:16 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
981	7.2	HIGH Network	-	-	CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order,…	CWE-94 Code Injection	CVE-2026-45708	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

982	9.1	CRITICAL Network	-	-	CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulnerability exists in multiple modules of CubeCart (including Email Templates, Inv…	CWE-94 CWE-1336 Code Injection Improper Neutralization of Special Elements Used in a Template Engine	CVE-2026-45714	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

983	8.3	HIGH Network	-	-	Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.	CWE-93 CRLF Injection	CVE-2026-32993	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

984	8.1	HIGH Network	-	-	Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.	CWE-89 SQL Injection	CVE-2026-29206	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

985	7.1	HIGH Network	-	-	Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.	CWE-863 Incorrect Authorization	CVE-2026-32991	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

986	4.8	MEDIUM Network	-	-	Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-middle attacker may access and modify commun…	CWE-319 Cleartext Transmission of Sensitive Information	CVE-2026-41281	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

987	7.1	HIGH Network	-	-	SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.	CWE-89 SQL Injection	CVE-2026-46445	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

988	7.1	HIGH Network	-	-	SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.	CWE-89 SQL Injection	CVE-2026-46446	2026-05-15 01:49	2026-05-14	Show	GitHub Exploit DB Packet Storm

989	-		-	-	Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitizat…	CWE-79 Cross-site Scripting	CVE-2026-5790	2026-05-15 01:46	2026-05-14	Show	GitHub Exploit DB Packet Storm

990	-		-	-	Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated at…	CWE-639 Authorization Bypass Through User-Controlled Key	CVE-2026-5798	2026-05-15 01:46	2026-05-14	Show	GitHub Exploit DB Packet Storm