Vulnerability Search Top
Show Search Menu
Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

  • Urgent
  • Important
  • Warning
  • Low
JVN Vulnerability Information

Update Date":May 20, 2026, 6 p.m.

No CVSS Level
Attach Vector
Vendor Name Project Name Title CWE CVE Update Date Publication Date Impact
Show
Exploit
PoC
Search
212541 4.3 警告 UNIT4 - UNIT4 Prosoft HRMS の Login.aspx におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング(XSS)
CVE-2015-2082 2015-02-27 16:04 2015-02-14 Show GitHub Exploit DB Packet Storm
212542 4.3 警告 Visualware - Visualware MyConnection Server におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング(XSS)
CVE-2015-2043 2015-02-27 15:49 2015-02-23 Show GitHub Exploit DB Packet Storm
212543 6.8 警告 ilch.de - Ilch CMS におけるクロスサイトリクエストフォージェリの脆弱性 CWE-352
同一生成元ポリシー違反
CVE-2015-2083 2015-02-27 15:30 2015-02-18 Show GitHub Exploit DB Packet Storm
212544 6.8 警告 シスコシステムズ - C-Series サーバ上で稼動する Cisco Unified Computing System の Integrated Management Controller におけるアクセス制限を回避される脆弱性 CWE-20
不適切な入力確認
CVE-2015-0633 2015-02-27 15:29 2015-02-25 Show GitHub Exploit DB Packet Storm
212545 4.3 警告 Vanilla Forums - Vanilla Forums におけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング(XSS)
CVE-2014-9685 2015-02-27 15:21 2014-08-3 Show GitHub Exploit DB Packet Storm
212546 4 警告 eTouch Systems - eTouch SamePage の cm/newui/blog/export.jsp におけるディレクトリトラバーサルの脆弱性 CWE-22
パス・トラバーサル
CVE-2015-2071 2015-02-27 11:39 2015-02-13 Show GitHub Exploit DB Packet Storm
212547 7.5 危険 eTouch Systems - eTouch SamePage Enterprise Edition における SQL インジェクションの脆弱性 CWE-89
SQLインジェクション
CVE-2015-2070 2015-02-27 11:39 2015-02-13 Show GitHub Exploit DB Packet Storm
212548 4.3 警告 Magmi project - Magento サーバ用 MAGMI プラグインにおけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング(XSS)
CVE-2015-2068 2015-02-27 11:21 2015-02-5 Show GitHub Exploit DB Packet Storm
212549 5 警告 Magmi project - Magento サーバ用 MAGMI プラグインの web/ajax_pluginconf.php におけるディレクトリトラバーサルの脆弱性 CWE-22
パス・トラバーサル
CVE-2015-2067 2015-02-27 11:21 2015-02-5 Show GitHub Exploit DB Packet Storm
212550 4.3 警告 WooThemes - WordPress 用 WooCommerce プラグインにおけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング(XSS)
CVE-2015-2069 2015-02-27 10:25 2015-01-29 Show GitHub Exploit DB Packet Storm
NVD Vulnerability Information

Update Date:May 20, 2026, 4:14 a.m.

No CVSS Level
Attach Vector
Vendor Name Project Name Title CWE CVE Update Date Publication Date Show Affected Exploit
PoC
Search
1941 7.5 HIGH
Network
- - apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded … CWE-345
CWE-494
 Insufficient Verification of Data Authenticity
 Download of Code Without Integrity Check
CVE-2026-42575 2026-05-14 00:23 2026-05-10 Show GitHub Exploit DB Packet Storm
1942 7.5 HIGH
Network
golang go The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). CWE-476
 NULL Pointer Dereference
CVE-2026-39836 2026-05-14 00:11 2026-05-8 Show GitHub Exploit DB Packet Storm
1943 7.5 HIGH
Network
golang go Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. CWE-770
 Allocation of Resources Without Limits or Throttling
CVE-2026-39820 2026-05-14 00:10 2026-05-8 Show GitHub Exploit DB Packet Storm
1944 5.3 MEDIUM
Local
golang go The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one… CWE-59
Link Following
CVE-2026-39819 2026-05-14 00:05 2026-05-8 Show GitHub Exploit DB Packet Storm
1945 5.9 MEDIUM
Local
golang go The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" su… CWE-787
 Out-of-bounds Write
CVE-2026-39817 2026-05-13 23:59 2026-05-8 Show GitHub Exploit DB Packet Storm
1946 10.0 CRITICAL
Network
peerigon angular-expressions Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox t… CWE-95
Eval Injection
CVE-2026-44643 2026-05-13 23:54 2026-05-12 Show GitHub Exploit DB Packet Storm
1947 9.4 CRITICAL
Network
- - phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been p… CWE-284
CWE-306
CWE-862
Improper Access Control
Missing Authentication for Critical Function
 Missing Authorization
CVE-2026-42569 2026-05-13 23:54 2026-05-10 Show GitHub Exploit DB Packet Storm
1948 8.5 HIGH
Local
- - JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved t… CWE-20
CWE-22
CWE-59
CWE-73
 Improper Input Validation 
Path Traversal
Link Following
 External Control of File Name or Path
CVE-2026-43989 2026-05-13 23:54 2026-05-13 Show GitHub Exploit DB Packet Storm
1949 - - - Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (… CWE-862
 Missing Authorization
CVE-2026-44012 2026-05-13 23:54 2026-05-13 Show GitHub Exploit DB Packet Storm
1950 9.9 CRITICAL
Network
openedx openedx Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply … CWE-918
Server-Side Request Forgery (SSRF) 
CVE-2026-42858 2026-05-13 23:53 2026-05-12 Show GitHub Exploit DB Packet Storm