Vulnerability Search Top
Show Search Menu
Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

  • Urgent
  • Important
  • Warning
  • Low
JVN Vulnerability Information

Update Date":May 27, 2026, 6 p.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Impact
Show		 Exploit
PoC
Search
205911 5.4 警告
Network 		サイボウズ - サイボウズ Office におけるアクセス制限回避の脆弱性 CWE-264
認可・権限・アクセス制御 		CVE-2015-8484
CVE-2015-8485
CVE-2015-8486
CVE-2016-1152 		2016-02-23 16:27 2016-02-15 Show GitHub Exploit DB Packet Storm
205912 4.3 警告
Network 		サイボウズ - サイボウズ Office における情報漏えいの脆弱性 CWE-200
情報漏えい 		CVE-2015-8487 2016-02-23 16:27 2016-02-15 Show GitHub Exploit DB Packet Storm
205913 4.3 警告
Network 		サイボウズ - サイボウズ Office における情報漏えいの脆弱性 CWE-264
認可・権限・アクセス制御 		CVE-2015-8488 2016-02-23 16:26 2016-02-15 Show GitHub Exploit DB Packet Storm
205914 6.5 警告
Network 		サイボウズ - サイボウズ Office におけるサービス運用妨害 (DoS) の脆弱性 CWE-20
不適切な入力確認 		CVE-2015-8489
CVE-2016-1153 		2016-02-23 16:25 2016-02-15 Show GitHub Exploit DB Packet Storm
205915 4.3 警告 Apache Software Foundation - Apache Solr の Admin UI の Stats ページの webapp/web/js/scripts/plugins.js におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2015-8797 2016-02-23 16:20 2015-08-24 Show GitHub Exploit DB Packet Storm
205916 4.3 警告 Apache Software Foundation - Apache Solr の Admin UI の webapp/web/js/scripts/schema-browser.js におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2015-8796 2016-02-23 16:20 2015-08-16 Show GitHub Exploit DB Packet Storm
205917 4.3 警告 Apache Software Foundation - Apache Solr の Admin UI におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2015-8795 2016-02-23 16:20 2015-04-6 Show GitHub Exploit DB Packet Storm
205918 4.3 警告 Roundcube.net - Roundcube の program/include/rcmail.php におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2015-8793 2016-02-23 16:15 2015-06-5 Show GitHub Exploit DB Packet Storm
205919 6.1 警告 シスコシステムズ - Cisco Industrial Ethernet 2000 デバイス上で稼動する Cisco IOS におけるサービス運用妨害 (DoS) の脆弱性 CWE-399
リソース管理の問題 		CVE-2016-1330 2016-02-23 13:58 2016-02-15 Show GitHub Exploit DB Packet Storm
205920 10 危険 シスコシステムズ - Cisco RV220W デバイスの Web ベースの管理インターフェースにおける SQL インジェクションの脆弱性 CWE-89
SQLインジェクション 		CVE-2015-6319 2016-02-23 12:28 2015-08-17 Show GitHub Exploit DB Packet Storm
NVD Vulnerability Information

Update Date:May 27, 2026, 4:52 a.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Show Affected Exploit
PoC
Search
591 6.1 MEDIUM
Network 		- - Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureApp#redirect_url method returns request.refer… CWE-601
Open Redirect 		CVE-2026-40295 2026-05-23 05:16 2026-05-23 Show GitHub Exploit DB Packet Storm
592 - - - NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated strin… - CVE-2026-39824 2026-05-23 05:16 2026-05-23 Show GitHub Exploit DB Packet Storm
593 8.8 HIGH
Network 		litellm litellm LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restri… CWE-863
 Incorrect Authorization 		CVE-2026-47102 2026-05-23 04:39 2026-05-22 Show GitHub Exploit DB Packet Storm
594 8.8 HIGH
Network 		litellm litellm LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored with… CWE-863
 Incorrect Authorization 		CVE-2026-47101 2026-05-23 04:39 2026-05-22 Show GitHub Exploit DB Packet Storm
595 9.8 CRITICAL
Network 		drupal drupal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.… CWE-89
SQL Injection 		CVE-2026-9082 2026-05-23 04:38 2026-05-21 Show GitHub Exploit DB Packet Storm
596 7.5 HIGH
Network 		apache cxf The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted use… CWE-20
 Improper Input Validation  		CVE-2026-44417 2026-05-23 04:29 2026-05-22 Show GitHub Exploit DB Packet Storm
597 5.4 MEDIUM
Network 		mattermost mattermost_server Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to g… CWE-863
 Incorrect Authorization 		CVE-2026-28735 2026-05-23 04:28 2026-05-23 Show GitHub Exploit DB Packet Storm
598 6.4 MEDIUM
Network 		concretecms concrete_cms For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and r… CWE-1287
 Improper Validation of Specified Type of Input 		CVE-2026-7887 2026-05-23 04:21 2026-05-22 Show GitHub Exploit DB Packet Storm
599 - - - authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the c… CWE-200
CWE-863
Information Exposure
 Incorrect Authorization 		CVE-2026-40166 2026-05-23 04:19 2026-05-23 Show GitHub Exploit DB Packet Storm
600 8.1 HIGH
Network 		- - authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows a caller with change_user on a target us… CWE-269
 Improper Privilege Management 		CVE-2026-40172 2026-05-23 04:19 2026-05-23 Show GitHub Exploit DB Packet Storm