https://vulnogram.org/ Most recent CVEs assigned by JPCERT/CC (jpcert). https://vulnogram.org/seaview/icons/jpcert.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-97627 https://vulnogram.org/CVE-2026-97627 Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands. High Tue, 20 Oct 2026 05:28:49 GMT https://vulnogram.org/CVE-2026-100737 https://vulnogram.org/CVE-2026-100737 Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware. Medium Tue, 20 Oct 2026 05:28:36 GMT https://vulnogram.org/CVE-2026-109831 https://vulnogram.org/CVE-2026-109831 UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition. Medium Tue, 20 Oct 2026 04:34:19 GMT https://vulnogram.org/CVE-2026-104679 https://vulnogram.org/CVE-2026-104679 VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive informati… High Mon, 19 Oct 2026 08:31:40 GMT https://vulnogram.org/CVE-2026-72528 https://vulnogram.org/CVE-2026-72528 "Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user ma… Medium Thu, 15 Oct 2026 08:29:55 GMT https://vulnogram.org/CVE-2026-75559 https://vulnogram.org/CVE-2026-75559 The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such… Medium Thu, 15 Oct 2026 08:28:39 GMT https://vulnogram.org/CVE-2026-96614 https://vulnogram.org/CVE-2026-96614 "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks… Medium Thu, 15 Oct 2026 08:25:39 GMT https://vulnogram.org/CVE-2026-105271 https://vulnogram.org/CVE-2026-105271 "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application. Medium Thu, 15 Oct 2026 08:24:18 GMT https://vulnogram.org/CVE-2026-103671 https://vulnogram.org/CVE-2026-103671 External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account in… Medium Wed, 14 Oct 2026 08:12:13 GMT https://vulnogram.org/CVE-2026-107153 https://vulnogram.org/CVE-2026-107153 Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed. High Unsupported When Assigned Wed, 14 Oct 2026 05:12:36 GMT https://vulnogram.org/CVE-2026-106931 https://vulnogram.org/CVE-2026-106931 SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. High Known Exploited Wed, 14 Oct 2026 04:45:07 GMT https://vulnogram.org/CVE-2026-101020 https://vulnogram.org/CVE-2026-101020 An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Conso… High Tue, 13 Oct 2026 08:40:15 GMT https://vulnogram.org/CVE-2026-92862 https://vulnogram.org/CVE-2026-92862 The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent. Medium Thu, 08 Oct 2026 02:54:38 GMT https://vulnogram.org/CVE-2026-92861 https://vulnogram.org/CVE-2026-92861 The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application. Medium Thu, 08 Oct 2026 02:53:50 GMT https://vulnogram.org/CVE-2026-103668 https://vulnogram.org/CVE-2026-103668 An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product. High Wed, 07 Oct 2026 10:19:10 GMT https://vulnogram.org/CVE-2026-96408 https://vulnogram.org/CVE-2026-96408 A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product. Critical Wed, 07 Oct 2026 10:18:47 GMT https://vulnogram.org/CVE-2026-100727 https://vulnogram.org/CVE-2026-100727 An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local". Medium Mon, 05 Oct 2026 06:36:00 GMT https://vulnogram.org/CVE-2026-92873 https://vulnogram.org/CVE-2026-92873 Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node. High Wed, 30 Sep 2026 07:51:52 GMT https://vulnogram.org/CVE-2026-92872 https://vulnogram.org/CVE-2026-92872 Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information. Medium Wed, 30 Sep 2026 07:47:50 GMT https://vulnogram.org/CVE-2026-92871 https://vulnogram.org/CVE-2026-92871 A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process. High Wed, 30 Sep 2026 07:47:32 GMT https://vulnogram.org/CVE-2026-93462 https://vulnogram.org/CVE-2026-93462 A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information. Medium Wed, 30 Sep 2026 07:42:31 GMT https://vulnogram.org/CVE-2026-93464 https://vulnogram.org/CVE-2026-93464 A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser. Medium Wed, 30 Sep 2026 07:34:33 GMT https://vulnogram.org/CVE-2026-93460 https://vulnogram.org/CVE-2026-93460 A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser. Medium Wed, 30 Sep 2026 07:34:09 GMT https://vulnogram.org/CVE-2026-93463 https://vulnogram.org/CVE-2026-93463 A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser. Medium Wed, 30 Sep 2026 07:33:53 GMT https://vulnogram.org/CVE-2026-92870 https://vulnogram.org/CVE-2026-92870 A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination. High Wed, 30 Sep 2026 07:21:24 GMT https://vulnogram.org/CVE-2026-92869 https://vulnogram.org/CVE-2026-92869 An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination. High Wed, 30 Sep 2026 07:21:09 GMT https://vulnogram.org/CVE-2026-92868 https://vulnogram.org/CVE-2026-92868 An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication. Medium Wed, 30 Sep 2026 07:20:48 GMT https://vulnogram.org/CVE-2026-92867 https://vulnogram.org/CVE-2026-92867 An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution. High Wed, 30 Sep 2026 07:20:27 GMT https://vulnogram.org/CVE-2026-97150 https://vulnogram.org/CVE-2026-97150 When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user. High Wed, 30 Sep 2026 07:12:22 GMT https://vulnogram.org/CVE-2026-81310 https://vulnogram.org/CVE-2026-81310 Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance. Medium Wed, 30 Sep 2026 01:51:54 GMT https://vulnogram.org/CVE-2026-78229 https://vulnogram.org/CVE-2026-78229 Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations. Medium Wed, 30 Sep 2026 01:51:37 GMT https://vulnogram.org/CVE-2026-95104 https://vulnogram.org/CVE-2026-95104 Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition. High Mon, 28 Sep 2026 08:14:36 GMT https://vulnogram.org/CVE-2026-86530 https://vulnogram.org/CVE-2026-86530 BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command. High Mon, 28 Sep 2026 08:14:00 GMT https://vulnogram.org/CVE-2026-75553 https://vulnogram.org/CVE-2026-75553 Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product. Low Fri, 25 Sep 2026 06:25:15 GMT https://vulnogram.org/CVE-2026-84408 https://vulnogram.org/CVE-2026-84408 QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges. High Wed, 16 Sep 2026 07:30:01 GMT https://vulnogram.org/CVE-2026-81326 https://vulnogram.org/CVE-2026-81326 QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password. Medium Wed, 16 Sep 2026 07:29:40 GMT https://vulnogram.org/CVE-2026-88263 https://vulnogram.org/CVE-2026-88263 XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the… High Wed, 16 Sep 2026 07:29:24 GMT https://vulnogram.org/CVE-2026-80217 https://vulnogram.org/CVE-2026-80217 Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands. High Tue, 15 Sep 2026 08:50:13 GMT https://vulnogram.org/CVE-2026-77853 https://vulnogram.org/CVE-2026-77853 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands. High Tue, 15 Sep 2026 08:49:58 GMT https://vulnogram.org/CVE-2026-86701 https://vulnogram.org/CVE-2026-86701 Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially al… Low Tue, 15 Sep 2026 05:51:38 GMT https://vulnogram.org/CVE-2026-85125 https://vulnogram.org/CVE-2026-85125 The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites. Medium Mon, 14 Sep 2026 06:46:32 GMT https://vulnogram.org/CVE-2026-82796 https://vulnogram.org/CVE-2026-82796 SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product. Medium Mon, 14 Sep 2026 06:46:22 GMT https://vulnogram.org/CVE-2026-82795 https://vulnogram.org/CVE-2026-82795 SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product. Medium Mon, 14 Sep 2026 06:46:12 GMT https://vulnogram.org/CVE-2026-82794 https://vulnogram.org/CVE-2026-82794 SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product. High Mon, 14 Sep 2026 06:46:04 GMT https://vulnogram.org/CVE-2026-82793 https://vulnogram.org/CVE-2026-82793 Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product… High Mon, 14 Sep 2026 06:45:52 GMT https://vulnogram.org/CVE-2026-82765 https://vulnogram.org/CVE-2026-82765 Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP. High Mon, 14 Sep 2026 06:45:44 GMT https://vulnogram.org/CVE-2026-82792 https://vulnogram.org/CVE-2026-82792 Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Medium Mon, 14 Sep 2026 06:45:32 GMT https://vulnogram.org/CVE-2026-82791 https://vulnogram.org/CVE-2026-82791 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by… High Mon, 14 Sep 2026 06:45:22 GMT https://vulnogram.org/CVE-2026-82790 https://vulnogram.org/CVE-2026-82790 Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser. Medium Mon, 14 Sep 2026 06:45:17 GMT https://vulnogram.org/CVE-2026-82789 https://vulnogram.org/CVE-2026-82789 An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). If exploited, arbitrary code may be executed by an attacker who can log in to the product. High Mon, 14 Sep 2026 06:44:56 GMT