Vulnerability Search Top
Show Search Menu
Vendor Name
プロダクト・サービス名
Title
CVE
Urgent
Important
Warning
Warning
CWE
公開-検索開始年
公開-検索開始月
公開-検索開始日
公開-検索終了年
公開-検索終了月
公開-検索終了日
レベルソート
In descending order of publication date
In descending order of update date
Number of items displayed

You can search for vulnerabilities managed by JVN (Japan Vulnerability Note) and NVD (National Vulnerability Database).
Search keywords must be entered in English otherwise will not be searched in both JVN and NVD.

To search by CWE, please refer to the CWE Overview and check the CWE number.

  • Urgent
  • Important
  • Warning
  • Low
JVN Vulnerability Information

Update Date":May 20, 2026, 6 p.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Impact
Show		 Exploit
PoC
Search
3981 7.2 重要
Network 		s9y Serendipity s9yのSerendipityにおけるHTTP レスポンス分割に関する脆弱性 CWE-113
HTTP レスポンスの分割 		CVE-2026-39971 2026-04-24 11:42 2026-04-15 Show GitHub Exploit DB Packet Storm
3982 7.1 重要
Local 		apktool apktool Apktoolにおけるパストラバーサルの脆弱性 CWE-22
パス・トラバーサル 		CVE-2026-39973 2026-04-24 11:42 2026-04-21 Show GitHub Exploit DB Packet Storm
3983 5.3 警告
Network 		Apache Software Foundation Apache log4net Apache Software FoundationのApache log4netにおけるエンコードおよびエスケープに関する脆弱性 CWE-116
不適切なエンコード、または出力のエスケープ 		CVE-2026-40021 2026-04-24 11:42 2026-04-10 Show GitHub Exploit DB Packet Storm
3984 5.3 警告
Network 		Daniel Gatis Rembg Daniel GatisのRembgにおける複数の脆弱性 CWE-22
CWE-73
CVE-2026-40086 2026-04-24 11:42 2026-04-10 Show GitHub Exploit DB Packet Storm
3985 5.4 警告
Network 		FUTO Immich FUTOのImmichにおける複数の脆弱性 CWE-601
CWE-79
CVE-2026-40096 2026-04-24 11:42 2026-04-15 Show GitHub Exploit DB Packet Storm
3986 8.2 重要
Network 		XWiki xwiki XWikiのxwikiにおける制限またはスロットリング無しのリソースの割り当てに関する脆弱性 CWE-770
制限またはスロットリング無しのリソースの割り当て 		CVE-2026-40104 2026-04-24 11:41 2026-04-15 Show GitHub Exploit DB Packet Storm
3987 6.1 警告
Network 		XWiki xwiki XWikiのxwikiにおけるクロスサイトスクリプティングの脆弱性 CWE-80
クロスサイトスクリプティング (Basic XSS) 		CVE-2026-40105 2026-04-24 11:41 2026-04-15 Show GitHub Exploit DB Packet Storm
3988 6.1 警告
Network 		Prometheus Prometheus Prometheusにおけるクロスサイトスクリプティングの脆弱性 CWE-79
クロスサイト・スクリプティング（XSS） 		CVE-2026-40179 2026-04-24 11:41 2026-04-15 Show GitHub Exploit DB Packet Storm
3989 7.5 重要
Network 		Python Software Foundation Python Pillow Python Software FoundationのPython Pillowにおける複数の脆弱性 CWE-400
CWE-770
CVE-2026-40192 2026-04-24 11:41 2026-04-15 Show GitHub Exploit DB Packet Storm
3990 8.2 重要
Network 		maddy project maddy maddy projectのmaddyにおけるLDAP インジェクションの脆弱性 CWE-90
LDAP インジェクション 		CVE-2026-40193 2026-04-24 11:41 2026-04-16 Show GitHub Exploit DB Packet Storm
NVD Vulnerability Information

Update Date:May 21, 2026, 4:10 a.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Show Affected Exploit
PoC
Search
881 9.8 CRITICAL
Network 		netty netty Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both… Update CWE-444
HTTP Request Smuggling 		CVE-2026-42581 2026-05-18 22:14 2026-05-14 Show GitHub Exploit DB Packet Storm
882 9.8 CRITICAL
Network 		espressif arduino-esp32 arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer multipart form parser in arduino-esp32 allocates a … Update CWE-121
Stack-based Buffer Overflow 		CVE-2026-42854 2026-05-18 22:09 2026-05-13 Show GitHub Exploit DB Packet Storm
883 8.8 HIGH
Network 		mongodb mongodb An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issu… Update CWE-787
 Out-of-bounds Write 		CVE-2026-8053 2026-05-18 22:06 2026-05-13 Show GitHub Exploit DB Packet Storm
884 7.5 HIGH
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handle… Update CWE-362
Race Condition 		CVE-2026-42594 2026-05-18 22:02 2026-05-15 Show GitHub Exploit DB Packet Storm
885 8.2 HIGH
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames t… Update CWE-73
CWE-184
 External Control of File Name or Path
 Incomplete Blacklist 		CVE-2026-40893 2026-05-18 22:02 2026-05-15 Show GitHub Exploit DB Packet Storm
886 8.2 HIGH
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the LibreOffice conversion endpoint (/forms/libreoffice/convert) passes uploaded documents directly to LibreOffice without … Update CWE-918
Server-Side Request Forgery (SSRF)  		CVE-2026-42591 2026-05-18 22:02 2026-05-15 Show GitHub Exploit DB Packet Storm
887 5.9 MEDIUM
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept url=file:///tmp/... from anonymous callers… Update CWE-73
CWE-918
 External Control of File Name or Path
Server-Side Request Forgery (SSRF)  		CVE-2026-42597 2026-05-18 22:02 2026-05-15 Show GitHub Exploit DB Packet Storm
888 5.3 MEDIUM
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, FilterOutboundURL resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only th… Update CWE-367
CWE-918
 Time-of-check Time-of-use (TOCTOU) Race Condition
Server-Side Request Forgery (SSRF)  		CVE-2026-42592 2026-05-18 22:02 2026-05-15 Show GitHub Exploit DB Packet Storm
889 9.8 CRITICAL
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes its keys directly to E… Update CWE-78
OS Command  		CVE-2026-42589 2026-05-18 22:01 2026-05-15 Show GitHub Exploit DB Packet Storm
890 5.3 MEDIUM
Network 		thecodingmachine gotenberg Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chromium/convert/html, and chromium/convert/… Update CWE-22
CWE-73
Path Traversal
 External Control of File Name or Path 		CVE-2026-42593 2026-05-18 22:01 2026-05-15 Show GitHub Exploit DB Packet Storm