"Handmade Marketplace App - Creema" vulnerable to open redirect

Overview "Handmade Marketplace App - Creema" provided by CREEMA LTD. contains the following vulnerability. Open redirect CWE-601 - CVE-2026-72528 Koki Sato of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

Multiple vulnerabilities in "GEO App"

Overview Mobile applications "GEO App" provided by GEO HOLDINGS CORPORATION contain multiple vulnerabilities listed below: Improper Authorization in Handler for Custom URL Scheme CWE-939 - CVE-2026-96614 Cleartext Storage of Sensitive Information CWE-312 - CVE-2026-105271 CVE-2026-96614 Shunsuke...

Smartphone application "Vehicle Inspection Certificate Viewer" vulnerable to sensitive information disclosure

Overview The smartphone application "Vehicle Inspection Certificate Viewer" provided by the Ministry of Land, Infrastructure, Transport and Tourism includes an API integration feature for operators handling vehicle inspection certificates. The specifications for the API integration contain the...

Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator

Overview Internal application information exposure vulnerability exists in Hitachi Ops Center Administrator. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take...

Multiple Vulnerabilities in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server

Overview Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server contain the vulnerabilities. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official...

Multiple Vulnerabilities in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center

Overview Multiple vulnerabilities have been found in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center. The product name in Hitachi Command Suite is changed in Hitachi Ops Center series on some...

Vulnerability in Cosminexus

Overview Cosminexus Developer's Kit for JavaTM and Hitachi Developer's Kit for Java contain the vulnerability. This vulnerability exists in Cosminexus Developer's Kit for JavaTM and Hitachi Developer's Kit for Java which are components of other Hitachi products. Impact Regarding the impact of the...

Multiple Vulnerabilities in Cosminexus

Overview Cosminexus Developer's Kit for JavaTM and Hitachi Developer's Kit for Java contain the vulnerabilities. The vulnerabilities exist in Cosminexus Developer's Kit for JavaTM and Hitachi Developer's Kit for Java which are components of other Hitachi products. Impact Regarding the impact of t...

Multiple Vulnerabilities in Cosminexus

Overview Cosminexus Developer's Kit for JavaTM and Hitachi Developer's Kit for Java contain the vulnerabilities. The vulnerabilities exist in Cosminexus Developer's Kit for JavaTM and Hitachi Developer's Kit for Java which are components of other Hitachi products. Impact Regarding the impact of t...

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

Overview EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin provided by EC-CUBE CO.,LTD. contains the following vulnerability. External Control of Assumed-Immutable Web Parameter CWE-472 - CVE-2026-103671 The developer states that attacks exploiting the vulnerability has been observed. EC-CUBE...

Multiple Rakuten Mobile smartphones shipped with a known private test key for Android Verified Boot

Overview Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. Use of Weak Credentials CWE-1391 - CVE-2026-107153 Masayoshi Matsubara reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

SiteGuard Server Edition vulnerable to OS command injection

Overview SiteGuard Server Edition provided by EG Secure Solutions Inc. is a host-based Web Application Firewall WAF designed to be integrated into a web server. The statistics feature of SiteGuard Server Edition contains the following vulnerability: OS command injection CWE-78 - CVE-2026-106931...

AssetView vulnerable to incorrect permission assignment for critical resource

Overview AssetView provided by Hammock Corporation contains the following vulnerability. Incorrect Permission Assignment for Critical Resource CWE-732 - CVE-2026-101020 Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer und...

Multiple vulnerabilities in Movable Type

Overview Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below: Code Injection in the Upgrade Script CWE-94 - CVE-2026-96408 SQL Injection in the Site Search function CWE-89 - CVE-2026-103668 In addition, multiple vulnerabilities have been addressed. For details,...

MCC Universal Library for Linux (uldaq) vulnerabile to buffer overflow

Overview Universal Library for Linux uldaq provided by Measurement Computing Corporation contains the following vulnerability: Stack-based Buffer Overflow CWE-121 - CVE-2026-19477 Tsurumi Junichi of Panasonic Holdings Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the...

Multiple vulnerabilities in Android application "Ticket Ryutsu Center"

Overview Android application "Ticket Ryutsu Center" provided by Wavedash Co., Ltd. contains multiple vulnerabilities listed below: Use of Hard-coded Credentials CWE-798 - CVE-2026-92861 Improper Authorization in Handler for Custom URL Scheme CWE-939 - CVE-2026-92862 Koki Sato of BroadBand Securit...

GROWI vulnerable to improper access control

Overview GROWI provided by GROWI, Inc. contains the following vulnerability: Files or Directories Accessible to External Parties CWE-552 - CVE-2026-100727 GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under...

Information Regarding Reported Vulnerabilities in Hitachi Coding Software Suite (HCSS)

Overview Hitachi Coding Software Suite hereinafter referred to as "HCSS" contains multiple vulnerabilities. Michael Heinzl reported these vulnerabilities. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' secti...

Path traversal vulnerability in FUJIFILM Business Innovation and Sharp MFPs (multifunction printers)

Overview Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Sharp Corporation contain a path traversal vulnerability. Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 - CVE-2026-78249 FUJIFILM Business Innovation Corp. report...

Multiple vulnerabilities in Image Scanner Driver for Linux

Overview Image Scanner Driver for Linux provided by PFU Limited contains multiple vulnerabilities listed below: OS Command Injection CWE-78 - CVE-2026-78229 Link Following CWE-59 - CVE-2026-81310 Nir Yehoshua of Cipher Security Labs reported these vulnerabilities to PFU Limited and coordinated...

Multiple vulnerabilities in Pgpool-II

Overview Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below: Out-of-bounds Write CWE-787 - CVE-2026-92867 Improper Certificate Validation CWE-295 - CVE-2026-92868 Out-of-bounds Write CWE-787 - CVE-2026-92869 Stack-based Buffer Overflow CWE-121 -...

Multiple vulnerabilities in BUFFALO Wi-Fi Products

Overview The web configuration user interfaces of Wi-Fi products provided by BUFFALO INC. contain multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2026-86530 Stack-based buffer overflow CWE-121 - CVE-2026-95104 Veeti Punnonen reported these vulnerabilities to JPCERT/CC...

Security information for Hitachi Disk Array Systems

Overview CVE-2026-42976 | Remote Access Management service/API RPC server Elevation of Privilege Vulnerability CVE-2026-49179 | Windows Active Directory Domain Services Remote Code Execution Vulnerability CVE-2026-50472 | Windows LUA File Virtualization Filter Driver Elevation of Privilege...

baserCMS plugin "BcAddonMigrator" vulnerable to inclusion of functionality from untrusted control sphere

Overview baserCMS plugin "BcAddonMigrator" provided by baserCMS Users Community contains the following vulnerability. Inclusion of Functionality from Untrusted Control Sphere CWE-829 - CVE-2026-97150 Kuniyoshi Noguchi KuniNogu of Mitsui Bussan Secure Directions, Inc. reported this vulnerability t...

Multiple vulnerabilities in baserCMS

Overview baserCMS provided by baserCMS User Community contains multiple vulnerabilities listed below: Cross-site scripting CWE-79 - CVE-2026-93460, CVE-2026-93463, CVE-2026-93464 SQL injection CWE-89 - CVE-2026-62956 Missing authentication for critical function CWE-306 - CVE-2026-93462...

Smartphone application Tohoku Electric Power "Yorisou e Net" vulnerable to use of hard-coded cryptographic key

Overview Smartphone application Tohoku Electric Power "Yorisou e Net" provided by Tohoku Electric Power Company, Incorporated contains the following vulnerability: Use of hard-coded cryptographic key CWE-321 - CVE-2026-75553 Yuta Sasaki of Ai Solutions Co., Ltd. reported this vulnerability to IPA...

XikeStor Layer3 switches miss authentication for downloading configuration data

Overview XikeStor Layer3 switches contain the vulnerability listed below. Missing authentication for downloading configuration CWE-306 - CVE-2026-88263 Impact Confidential information, such as network configurations or passwords, may be retrieved by an unauthenticated attacker. This allows the...

Multiple vulnerabilities in QND

Overview QND Standard/Premium provided by QualitySoft Corporation contains multiple vulnerabilities listed below: Use of hard-coded cryptographic key CWE-321 - CVE-2026-81326 Improper access control on a named pipe CWE-782 - CVE-2026-84408 Taisei Ogura of MOTEX Inc. reported this vulnerability to...

Panasonic Industry MINAS A5/A6 USB device drivers for Windows vulnerable to buffer overflow

Overview MINAS A5/A6 USB device drivers for Windows provided by Panasonic Industry Co., Ltd. contain the following vulnerability. Classic Buffer Overflow CWE-120 - CVE-2026-16726 Luca Borzacchiello of Nozomi Networks reported the issue directly to Panasonic. Panasonic reported this issue to...

Multiple vulnerabilities in Lite-On O-RU "FF-RFI079I4" and "FF-RFI078I4"

Overview O-RU "FF-RFI079I4" and "FF-RFI078I4" provided by LITE-ON Technology Corporation contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-77853 Hidden Functionality CWE-912 - CVE-2026-80217 Yuto Aono, Yutaro Osako, and Shunsuke Saruwatari of The University of...

Improper access control vulnerability in Android application "ManabiPocket for Parents"

Overview Android application "ManabiPocket for Parents" provided by NTT DOCOMO BUSINESS, Inc. contains the following vulnerability: Improper Export of Android Application Components CWE-926 - CVE-2026-86701 The CVSS below assumes that sensitive information within the affected application is...

Multiple vulnerabilities in SolarView Compact

Overview SolarView Compact provided by Contec Co., Ltd. contains multiple vulnerabilities listed below. OS command injection in Schedule Settings CWE-78 - CVE-2026-82794 Cross-site scripting in Schedule Settings and Mail Send Setting CWE-79 - CVE-2026-82795 Cross-site scripting in Image Managemen...

Multiple vulnerabilities in Contec PC-HELPER series

Overview PC-HELPER series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2026-82790 Cross-site request forgery CWE-352 - CVE-2026-82764 OS command injection CWE-78 - CVE-2026-82791 Cross-site scripting CWE-79 - CVE-2026-82792...

Multiple vulnerabilities in Contec FLEXLAN series

Overview FLEXLAN series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2026-82762, CVE-2026-82766 Cross-site scripting CWE-79 - CVE-2026-82763, CVE-2026-82769, CVE-2026-82771 Cross-site request forgery CWE-352 - CVE-2026-82764 Path...

Multiple vulnerabilities in Contec CONPROSYS series

Overview CONPROSYS series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2026-82773, CVE-2026-82776, CVE-2026-82788 OS command injection CWE-78 - CVE-2026-82774, CVE-2026-82777, CVE-2026-82779 Exposure of information through director...

"YAMAP -Social Trekking GPS App" vulnerable to improper access control

Overview Android application "YAMAP -Social Trekking GPS App" provided by YAMAP INC. contains the following vulnerability: Improper Verification of Source of a Communication Channel CWE-940 - CVE-2026-85125 Koki Sato of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC...

Security information for Hitachi Disk Array Systems

Overview CVE-2026-33842 | Windows File Explorer Information Disclosure Vulnerability CVE-2026-34328 | Windows Audio Service Information Disclosure Vulnerability CVE-2026-34346 | Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability CVE-2026-34348 | Windows Event Loggi...

Vulnerability in Cosminexus

Overview A command argument Injection vulnerability exists in the operation management agent of Cosminexus Component Container. These vulnerabilities exist in Cosminexus Component Container which is a component product of other Hitachi products. Impact Regarding the impact of the vulnerability,...

Vulnerability in Cosminexus

Overview A command injection vulnerability exists in the operation management agent of Cosminexus Component Container. These vulnerabilities exist in Cosminexus Component Container which is a component product of other Hitachi products. Impact Regarding the impact of the vulnerability, please ref...

Vulnerability in Cosminexus Component Container

Overview Cosminexus Service Coordinator, which uses the SOAP communication infrastructure of Cosminexus Component Container, contains an XXE XML External Entity vulnerability in user-defined reception services SOAP reception services or SOAP adapters operating in SOAP 1.1 mode. Impact Regarding t...

Vulnerability in Cosminexus

Overview Insecure deserialization vulnerability exists in Cosminexus Component Container. These vulnerabilities exist in Cosminexus Component Container which is a component product of other Hitachi products. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory...

a-blog cms vulnerable to path traversal

Overview a-blog cms provided by appleple inc. contains the following vulnerability. Path traversal CWE-22 - CVE-2026-87727 You are affected by this vulnerability only when "Attaching files to emails addressed to the administrator" is enabled in the form settings. hibiki moriyama of STNet,...

Multiple vulnerabilities in SHIRASAGI

Overview SHIRASAGI provided by SHIRASAGI Project contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2026-81635 Authorization bypass CWE-639 - CVE-2026-82582 CVE-2026-81635 Tonosaki Aoba of Tokyo Denki University remote control Laboratory reported this vulnerability ...

Multiple vulnerabilities in baserCMS plugin "BurgerEditor"

Overview baserCMS plugin "BurgerEditor" provided by D-ZERO CO.,LTD. contains multiple vulnerabilities listed below: Authorization Bypass Through User-Controlled Key CWE-639 - CVE-2026-84062 Unrestricted Upload of File with Dangerous Type CWE-434 - CVE-2026-84063 Kuniyoshi Noguchi @KuniNogu report...

Multiple vulnerabilities in XING CPTrans-ME-X

Overview CPTrans-ME-X provided by XING Inc. contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-62928 Improper processing of the input through the administrative port may lead to OS command injection. Exposure of Sensitive System Information to an Unauthorized...

Multiple Keyence products vulnerable to improper restriction of XML external entity reference

Overview XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation contain the following vulnerability. Improper restriction of XML external entity reference CWE-611 - CVE-2026-82918 Michael Heinzl reported these...

Multiple vulnerabilities in ShizenBox2

Overview ShizenBox2 provided by Shizen Connect Inc. contains multiple vulnerabilities listed below. Improper physical access control CWE-1263 - CVE-2026-80253 Authorization bypass through user-controlled key CWE-639 - CVE-2026-80254 CVE-2026-80253 Naohide Waguri of PwC Consulting LLC reported thi...

PALLET CONTROL products vulnerable to improper access control

Overview PALLET CONTROL products provided by JAL Digital Co.,Ltd. include multiple service programs that run in the background and provide certain functions. However, access to these service programs is not properly restricted, allowing non-administrative users to access them. Improper access...

Multiple vulnerabilities in GROWI

Overview GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below: Authorization bypass through user-controlled key in the bookmark folder APIs CWE-639 - CVE-2026-53620 Incorrect authorization in the bookmark listing APIs CWE-863 - CVE-2026-68951 CVE-2026-53620 Masashi Kawamot...

Zabbix agent may insecurely load Dynamic Link Libraries

Overview Zabbix agent provided by Zabbix LLC may load Dynamic Link Libraries insecurely due to the following vulnerability. Incorrect default permissions CWE-276 - CVE-2026-59781 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with th...