Most recent entries from jvndb

jvndb-2026-036180

2026-10-02T11:53:00+09:00

Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Sharp Corporation contain a path traversal vulnerability.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) - CVE-2026-78249

FUJIFILM Business Innovation Corp. reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC coordinated with FUJIFILM Business Innovation Corp. and Sharp Corporation.

jvndb-2026-035987

2026-09-30T14:12:00+09:00

Image Scanner Driver for Linux provided by PFU Limited contains multiple vulnerabilities listed below:

OS Command Injection (CWE-78) - CVE-2026-78229
Link Following (CWE-59) - CVE-2026-81310

Nir Yehoshua of Cipher Security Labs reported these vulnerabilities to PFU Limited and coordinated. After the coordination was completed, PFU Limited reported the case to JPCERT/CC to notify users of the solution through JVN.

jvndb-2026-000140

2026-09-29T15:53:00+09:00

Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below:

Out-of-bounds Write (CWE-787) - CVE-2026-92867
Improper Certificate Validation (CWE-295) - CVE-2026-92868
Out-of-bounds Write (CWE-787) - CVE-2026-92869
Stack-based Buffer Overflow (CWE-121) - CVE-2026-92870
NULL Pointer Dereference (CWE-476) - CVE-2026-92871
Insertion of Sensitive Information into Log File (CWE-532) - CVE-2026-92872
Incorrect Implementation of Authentication Algorithm (CWE-303) - CVE-2026-92873

Emond Papegaaij of Topicus Security reported these vulnerabilities to Pgpool Global Development Group and coordinated. Pgpool Global Development Group and JPCERT/CC published respective advisories in order to notify users of this vulnerability.

jvndb-2026-035794

2026-09-29T13:35:00+09:00

The web configuration user interfaces of Wi-Fi products provided by BUFFALO INC. contain multiple vulnerabilities listed below.

OS command injection (CWE-78) - CVE-2026-86530
Stack-based buffer overflow (CWE-121) - CVE-2026-95104

Veeti Punnonen reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.

jvndb-2026-033235

2026-09-29T12:18:00+09:00

CONPROSYS series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.

Cross-site scripting (CWE-79) - CVE-2026-82773, CVE-2026-82776, CVE-2026-82788
OS command injection (CWE-78) - CVE-2026-82774, CVE-2026-82777, CVE-2026-82779
Exposure of information through directory listing (CWE-548…

jvndb-2026-035789

2026-09-28T12:02:00+09:00

CVE-2026-42976 | Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability CVE-2026-49179 | Windows Active Directory Domain Services Remote Code Execution Vulnerability CVE-2026-50472 | Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability CVE-2026-54113 | Remote Procedure Call Denial of Service Vulnerability CVE-2026-54984 | Windows Imaging Component Remote Code Execution Vulnerability CVE-2026-56174 | Windows Narrator Braille Elevation of Privilege Vulnerability CVE-2026-59122 | Windows Telephony Service Elevation of Privilege Vulnerability CVE-2026-59125 | Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability CVE-2026-59126 | Windows Event Logging Service Elevation of Privilege Vulnerability CVE-2026-59127 | Windows Installer Elevation of Privilege Vulnerability CVE-2026-59128 | Windows Encrypting File System (EFS) Information Disclosure Vulnerability CVE-2026-59130 | AMD Zen Information Disclosure Vulnerability CVE-2026-59131 | AMD Zen Information Disclosure Vulnerability CVE-2026-59132 | Windows TCP/IP Denial of Service Vulnerability CVE-2026-59134 | Remote Desktop Client Remote Code Execution Vulnerability CVE-2026-59135 | Microsoft Windows Search Component Information Disclosure Vulnerability CVE-2026-59136 | Microsoft COM for Windows Information Disclosure Vulnerability CVE-2026-59137 | Windows Event Logging Service Information Disclosure Vulnerability CVE-2026-59138 |…

jvndb-2026-000141

2026-09-25T14:48:00+09:00

baserCMS provided by baserCMS User Community contains multiple vulnerabilities listed below:

Cross-site scripting (CWE-79) - CVE-2026-93460, CVE-2026-93463, CVE-2026-93464
SQL injection (CWE-89) - CVE-2026-62956
Missing authentication for critical function (CWE-306) - CVE-2026-93462

CVE-2026-93460 So Kato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-62956, CVE-2026-93462 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-93463 Gai Tanaka of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-93464 Kuniyoshi Noguchi (KuniNogu) of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

jvndb-2026-000138

2026-09-25T14:48:00+09:00

baserCMS plugin "BcAddonMigrator" provided by baserCMS Users Community contains the following vulnerability.

Inclusion of Functionality from Untrusted Control Sphere (CWE-829) - CVE-2026-97150

Kuniyoshi Noguchi (KuniNogu) of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

jvndb-2026-000137

2026-09-17T18:06:00+09:00

Smartphone application Tohoku Electric Power "Yorisou e Net" provided by Tohoku Electric Power Company, Incorporated contains the following vulnerability:

Use of hard-coded cryptographic key (CWE-321) - CVE-2026-75553

Yuta Sasaki of Ai Solutions Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

jvndb-2026-000135

2026-09-16T15:05:00+09:00

QND Standard/Premium provided by QualitySoft Corporation contains multiple vulnerabilities listed below:

Use of hard-coded cryptographic key (CWE-321) - CVE-2026-81326
Improper access control on a named pipe (CWE-782) - CVE-2026-84408

Taisei Ogura of MOTEX Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.