NVD脆弱性情報トップ

検索メニュー表示

ベンダー名
プロダクト・サービス名
タイトル
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
公表日降順
更新日降順
表示数

NVD（National Vulnerability Database）で管理されている脆弱性の一覧を検索することが出来ます。
JVN（Japan Vulnerability Note）より先に脆弱性情報が更新される事が多いため、JVNに未記載の脆弱性が更新されている場合があります。

JVN（Japan Vulnerability Note）に関連した脆弱性がある場合は詳細画面で情報を表示します。

CWEで検索する場合は、CWE概要を参照して、CWE番号を確認してください。

CRITICAL
HIGH
MEDIUM
LOW

更新日:2026年4月24日4:00

No	CVSS	レベル攻撃区分	ベンダー名	プロダクト名	タイトル	CWE	CVE	更新日	公表日	影響表示	Exploit PoC 検索
1401	8.8	HIGH ネットワーク	kubeai	kubeai	KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sp…	CWE-78 OSコマンド・インジェクション	CVE-2026-34940	2026-04-15 05:28	2026-04-7	表示	GitHub Exploit DB Packet Storm

1402	6.1	MEDIUM ネットワーク	salesforce	workbench	Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site script…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2026-34951	2026-04-15 05:28	2026-04-7	表示	GitHub Exploit DB Packet Storm

1403	8.1	HIGH ネットワーク	montferret	ferret	Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to writ…	CWE-22 CWE-73 パス・トラバーサルファイル名やパス名の外部制御	CVE-2026-34783	2026-04-15 05:28	2026-04-7	表示	GitHub Exploit DB Packet Storm

1404	7.7	HIGH ネットワーク	openobserve	openobserve	OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses bec…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2026-39361	2026-04-15 05:28	2026-04-8	表示	GitHub Exploit DB Packet Storm

1405	5.0	MEDIUM ネットワーク	linkace	linkace	LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read respons…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2026-35516	2026-04-15 05:27	2026-04-8	表示	GitHub Exploit DB Packet Storm

1406	9.8	CRITICAL ネットワーク	webtechnologies	changedetection	changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. …	CWE-863 不正な認証	CVE-2026-35490	2026-04-15 05:27	2026-04-8	表示	GitHub Exploit DB Packet Storm

1407	9.8	CRITICAL ネットワーク	thecodingmachine	gotenberg	Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access …	CWE-1333 非効率的な正規表現の複雑さ	CVE-2026-35458	2026-04-15 05:27	2026-04-8	表示	GitHub Exploit DB Packet Storm

1408	7.5	HIGH ネットワーク	orthanc-server	orthanc	A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memory directly based on the attacker supplied header value with…	CWE-770 制限またはスロットリング無しのリソースの割り当て	CVE-2026-5440	2026-04-15 05:26	2026-04-10	表示	GitHub Exploit DB Packet Storm

1409	7.1	HIGH ローカル	orthanc-server	orthanc	A heap buffer overflow vulnerability exists in the PAM image parsing logic. When Orthanc processes a crafted PAM image embedded in a DICOM file, image dimensions are multiplied using 32-bit unsigned …	CWE-787 境界外書き込み	CVE-2026-5444	2026-04-15 05:20	2026-04-10	表示	GitHub Exploit DB Packet Storm

1410	9.8	CRITICAL ネットワーク	orthanc-server	orthanc	A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pixel length validation uses 32-bit multiplication for width and height calculations. If these values …	CWE-787 境界外書き込み	CVE-2026-5443	2026-04-15 05:19	2026-04-10	表示	GitHub Exploit DB Packet Storm

1411	9.8	CRITICAL ネットワーク	orthanc-server	orthanc	A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded using Value Representation (VR) Unsigned Long (UL), instead of the expected VR Unsigned Short (US)…	CWE-787 境界外書き込み	CVE-2026-5442	2026-04-15 05:19	2026-04-10	表示	GitHub Exploit DB Packet Storm

1412	7.1	HIGH ローカル	orthanc-server	orthanc	An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routine, which decodes the proprietary Philips Compression form…	CWE-125 境界外読み取り	CVE-2026-5441	2026-04-15 05:18	2026-04-10	表示	GitHub Exploit DB Packet Storm

1413	7.1	HIGH ローカル	libexif_project	libexif	In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems.	CWE-190 整数オーバーフローまたはラップアラウンド	CVE-2026-40385	2026-04-15 05:15	2026-04-13	表示	GitHub Exploit DB Packet Storm

1414	7.7	HIGH ネットワーク	goshs	goshs	goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the…	CWE-1314	CVE-2026-40188	2026-04-15 05:15	2026-04-11	表示	GitHub Exploit DB Packet Storm

1415	6.5	MEDIUM ネットワーク	nearform	fast-jwt	fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular…	CWE-1333 非効率的な正規表現の複雑さ	CVE-2026-35041	2026-04-15 05:15	2026-04-10	表示	GitHub Exploit DB Packet Storm

1416	8.2	HIGH ネットワーク	opnsense	opnsense	OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap…	CWE-90 LDAP インジェクション	CVE-2026-34578	2026-04-15 05:14	2026-04-10	表示	GitHub Exploit DB Packet Storm

1417	9.9	CRITICAL ネットワーク	axios	axios	Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback…	CWE-441 CWE-918 フィルタリング回避サーバサイドリクエストフォージェリ	CVE-2025-62718	2026-04-15 05:14	2026-04-10	表示	GitHub Exploit DB Packet Storm

1418	7.3	HIGH ネットワーク	tandoor	recipes	Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from req…	CWE-639 CWE-1284 ユーザ制御の鍵による認証回避入力で指定された数量の不適切な検証	CVE-2026-35489	2026-04-15 05:13	2026-04-8	表示	GitHub Exploit DB Packet Storm

1419	7.5	HIGH ネットワーク	kagi	fastfeedparser	FastFeedParser is a high performance RSS, Atom and RDF parser. Prior to 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls…	CWE-674 不適切な再帰制御	CVE-2026-39376	2026-04-15 05:12	2026-04-8	表示	GitHub Exploit DB Packet Storm

1420	9.1	CRITICAL ネットワーク	jizhicms	jizhicms	Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.	CWE-918 サーバサイドリクエストフォージェリ	CVE-2025-50228	2026-04-15 05:11	2026-04-10	表示	GitHub Exploit DB Packet Storm

1421	9.1	CRITICAL ネットワーク	orthanc-server	orthanc	An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`. The lookup-table decoding logic used for `PALETTE COLOR` images does not validate pixel …	CWE-125 境界外読み取り	CVE-2026-5445	2026-04-15 05:10	2026-04-10	表示	GitHub Exploit DB Packet Storm

1422	7.8	HIGH ローカル	hdfgroup	hdf5	HDF5 is software for managing data. In 1.14.1-2 and earlier, a heap-use-after-free was found in the h5dump helper utility. An attacker who can supply a malicious h5 file can trigger a heap use-after-…	CWE-416 解放済みメモリの使用	CVE-2026-34734	2026-04-15 05:09	2026-04-10	表示	GitHub Exploit DB Packet Storm

1423	8.2	HIGH ネットワーク	gitroom	postiz	Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct p…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2026-40168	2026-04-15 05:09	2026-04-11	表示	GitHub Exploit DB Packet Storm

1424	9.8	CRITICAL ネットワーク	goshs	goshs	goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enfor…	CWE-862 認証の欠如	CVE-2026-40189	2026-04-15 05:08	2026-04-11	表示	GitHub Exploit DB Packet Storm

1425	7.5	HIGH ネットワーク	softether	softethervpn	SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authentication denial-of-service vulnerability exists in SoftEther VPN Developer Edition 5.2…	CWE-789 過剰なサイズ値のメモリ割り当て	CVE-2026-39312	2026-04-15 05:08	2026-04-8	表示	GitHub Exploit DB Packet Storm

1426	9.1	CRITICAL ネットワーク	docker	model_runner	Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exc…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2026-33990	2026-04-15 05:08	2026-04-2	表示	GitHub Exploit DB Packet Storm

1427	9.8	CRITICAL ネットワーク	xwiki	xwiki	XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script…	CWE-862 認証の欠如	CVE-2026-33229	2026-04-15 05:08	2026-04-9	表示	GitHub Exploit DB Packet Storm

1428	8.6	HIGH ネットワーク	patrickjuchli	basic-ftp	basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(),…	CWE-93 CRLF インジェクション	CVE-2026-39983	2026-04-15 05:07	2026-04-10	表示	GitHub Exploit DB Packet Storm

1429	6.1	MEDIUM ネットワーク	unjs	unhead	Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in <head> safe…	CWE-184 不完全なブラックリスト	CVE-2026-39315	2026-04-15 05:07	2026-04-10	表示	GitHub Exploit DB Packet Storm

1430	7.5	HIGH ネットワーク	apache	tomcat	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through …	CWE-444 HTTP リクエストスマグリング	CVE-2026-24880	2026-04-15 05:02	2026-04-10	表示	GitHub Exploit DB Packet Storm

1431	8.8	HIGH ネットワーク	google	chrome	Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)	CWE-416 解放済みメモリの使用	CVE-2026-5877	2026-04-15 05:02	2026-04-9	表示	GitHub Exploit DB Packet Storm

1432	4.3	MEDIUM ネットワーク	google	chrome	Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)	CWE-451 ユーザインターフェースにおける重要情報の誤った表示	CVE-2026-5878	2026-04-15 05:02	2026-04-9	表示	GitHub Exploit DB Packet Storm

1433	4.3	MEDIUM ネットワーク	google	chrome	Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar)…	CWE-451 ユーザインターフェースにおける重要情報の誤った表示	CVE-2026-5880	2026-04-15 05:01	2026-04-9	表示	GitHub Exploit DB Packet Storm

1434	6.5	MEDIUM ネットワーク	google	chrome	Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)	CWE-284 不適切なアクセス制御	CVE-2026-5881	2026-04-15 05:01	2026-04-9	表示	GitHub Exploit DB Packet Storm

1435	4.3	MEDIUM ネットワーク	google	chrome	Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)	CWE-451 ユーザインターフェースにおける重要情報の誤った表示	CVE-2026-5882	2026-04-15 05:01	2026-04-9	表示	GitHub Exploit DB Packet Storm

1436	9.8	CRITICAL ネットワーク	pgx_project	pgx	Memory-safety vulnerability in github.com/jackc/pgx/v5.	NVD-CWE-noinfo	CVE-2026-33816	2026-04-15 05:01	2026-04-8	表示	GitHub Exploit DB Packet Storm

1437	9.8	CRITICAL ネットワーク	pgx_project	pgx	Memory-safety vulnerability in github.com/jackc/pgx/v5.	NVD-CWE-noinfo	CVE-2026-33815	2026-04-15 04:58	2026-04-8	表示	GitHub Exploit DB Packet Storm

1438	7.5	HIGH ネットワーク	ech0	ech0	Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is l…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2026-35036	2026-04-15 04:58	2026-04-7	表示	GitHub Exploit DB Packet Storm

1439	8.8	HIGH ネットワーク	devcode	openstamanager	OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in OpenSTAManager contain an SQL Injec…	CWE-89 SQLインジェクション	CVE-2026-35470	2026-04-15 04:58	2026-04-7	表示	GitHub Exploit DB Packet Storm

1440	4.3	MEDIUM ネットワーク	wwbn	avideo	WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is exp…	CWE-352 同一生成元ポリシー違反	CVE-2026-35181	2026-04-15 04:57	2026-04-7	表示	GitHub Exploit DB Packet Storm

1441	3.7	LOW ネットワーク	wwbn	avideo	WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authenti…	CWE-862 認証の欠如	CVE-2026-35448	2026-04-15 04:57	2026-04-7	表示	GitHub Exploit DB Packet Storm

1442	5.5	MEDIUM ローカル	systemd_project	systemd	In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.	CWE-1025 誤った要素を使用した比較	CVE-2026-40227	2026-04-15 04:41	2026-04-11	表示	GitHub Exploit DB Packet Storm

1443	6.5	MEDIUM ネットワーク	microsoft	sharepoint_server	Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.	CWE-20 不適切な入力確認	CVE-2026-32201	2026-04-15 04:37	2026-04-15	表示	GitHub Exploit DB Packet Storm

1444	7.8	HIGH ローカル	gimp	gimp	GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is…	CWE-190 整数オーバーフローまたはラップアラウンド	CVE-2026-4154	2026-04-15 04:33	2026-04-11	表示	GitHub Exploit DB Packet Storm

1445	7.8	HIGH ローカル	gimp	gimp	GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User inte…	CWE-122 CWE-787 ヒープオーバーフロー境界外書き込み	CVE-2026-4153	2026-04-15 04:33	2026-04-11	表示	GitHub Exploit DB Packet Storm

1446	7.8	HIGH ローカル	gimp	gimp	GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is…	CWE-190 整数オーバーフローまたはラップアラウンド	CVE-2026-4151	2026-04-15 04:32	2026-04-11	表示	GitHub Exploit DB Packet Storm

1447	9.8	CRITICAL ネットワーク	mrcms	mrcms	MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addi…	CWE-284 不適切なアクセス制御	CVE-2026-31272	2026-04-15 04:32	2026-04-8	表示	GitHub Exploit DB Packet Storm

1448	7.8	HIGH ローカル	gimp	gimp	GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User inte…	CWE-122 CWE-787 ヒープオーバーフロー境界外書き込み	CVE-2026-4152	2026-04-15 04:32	2026-04-11	表示	GitHub Exploit DB Packet Storm

1449	7.8	HIGH ローカル	gimp	gimp	GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is…	CWE-190 整数オーバーフローまたはラップアラウンド	CVE-2026-4150	2026-04-15 04:32	2026-04-11	表示	GitHub Exploit DB Packet Storm

1450	9.8	CRITICAL ネットワーク	statamcp	stata-mcp	A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.	CWE-94 コード・インジェクション	CVE-2026-31040	2026-04-15 04:31	2026-04-9	表示	GitHub Exploit DB Packet Storm