Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

jvndb-2026-000089

Vulnerability from jvndb

Published

2026-08-28 15:52

Modified

2026-08-28 15:52

Severity ?

6.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

Multiple vulnerabilities in GROWI

Details

GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below:<a href='https://cwe.mitre.org/data/definitions/639.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/863.html' target='_blank'></a><ul><li>Authorization bypass through user-controlled key in the bookmark folder APIs (CWE-639) - CVE-2026-53620</li><li>Incorrect authorization in the bookmark listing APIs (CWE-863) - CVE-2026-68951</li></ul>CVE-2026-53620 Masashi Kawamoto reported this vulnerability to JPCERT/CC, and Fumito Otake of The Japan Research Institute, Limited. reported the same vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-68951 GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN42348352/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-53620
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-68951
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000089.html",
  "dc:date": "2026-08-28T15:52+09:00",
  "dcterms:issued": "2026-08-28T15:52+09:00",
  "dcterms:modified": "2026-08-28T15:52+09:00",
  "description": "GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below:\u003ca href=\u0027https://cwe.mitre.org/data/definitions/639.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/863.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eAuthorization bypass through user-controlled key in the bookmark folder APIs (CWE-639) - CVE-2026-53620\u003c/li\u003e\u003cli\u003eIncorrect authorization in the bookmark listing APIs (CWE-863) - CVE-2026-68951\u003c/li\u003e\u003c/ul\u003eCVE-2026-53620\r\nMasashi Kawamoto reported this vulnerability to JPCERT/CC, and Fumito Otake of The Japan Research Institute, Limited. reported the same vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2026-68951\r\nGROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000089.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000089",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN42348352/index.html",
      "@id": "JVN#42348352",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-53620",
      "@id": "CVE-2026-53620",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-68951",
      "@id": "CVE-2026-68951",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in GROWI"
}

jvndb-2026-000071

Vulnerability from jvndb

Published

2026-05-11 18:20

Modified

2026-05-11 18:20

Severity ?

7.2 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

GROWI vulnerable to path traversal

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/22.html' target='_blank'></a><ul><li>Path traversal (CWE-22) - CVE-2026-41951</li></ul>GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN38788367/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-41951
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000071.html",
  "dc:date": "2026-05-11T18:20+09:00",
  "dcterms:issued": "2026-05-11T18:20+09:00",
  "dcterms:modified": "2026-05-11T18:20+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/22.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003ePath traversal (CWE-22) - CVE-2026-41951\u003c/li\u003e\u003c/ul\u003eGROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000071.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.2",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000071",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN38788367/index.html",
      "@id": "JVN#38788367",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-41951",
      "@id": "CVE-2026-41951",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "GROWI vulnerable to path traversal"
}

jvndb-2026-000064

Vulnerability from jvndb

Published

2026-04-23 16:57

Modified

2026-04-30 12:19

Severity ?

7.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

GROWI vulnerable to Regular expression Denial-of-Service (ReDoS)

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/1333.html' target='_blank'></a><ul><li>Inefficient regular expression complexity (CWE-1333) - CVE-2026-41040</li></ul>Sho Odagiri of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to GROWI, Inc. and coordinated. After the coordination was completed, GROWI, Inc. reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN46728373/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-41040
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000064.html",
  "dc:date": "2026-04-30T12:19+09:00",
  "dcterms:issued": "2026-04-23T16:57+09:00",
  "dcterms:modified": "2026-04-30T12:19+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/1333.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eInefficient regular expression complexity (CWE-1333) - CVE-2026-41040\u003c/li\u003e\u003c/ul\u003eSho Odagiri of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to GROWI, Inc. and coordinated. After the coordination was completed, GROWI, Inc. reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000064.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000064",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN46728373/index.html",
      "@id": "JVN#46728373",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-41040",
      "@id": "CVE-2026-41040",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "GROWI vulnerable to Regular expression Denial-of-Service (ReDoS)"
}

jvndb-2026-000055

Vulnerability from jvndb

Published

2026-04-15 17:21

Modified

2026-04-15 17:21

Severity ?

5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

GROWI vulnerable to stored cross-site scripting

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><ul><li>Stored cross-site scripting (CWE-79) - CVE-2026-26291</li></ul>Norihide Saito reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN62079296/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-26291
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000055.html",
  "dc:date": "2026-04-15T17:21+09:00",
  "dcterms:issued": "2026-04-15T17:21+09:00",
  "dcterms:modified": "2026-04-15T17:21+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eStored cross-site scripting (CWE-79) - CVE-2026-26291\u003c/li\u003e\u003c/ul\u003eNorihide Saito reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000055.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.4",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000055",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN62079296/index.html",
      "@id": "JVN#62079296",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-26291",
      "@id": "CVE-2026-26291",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "GROWI vulnerable to stored cross-site scripting"
}

jvndb-2026-000039

Vulnerability from jvndb

Published

2026-03-16 17:18

Modified

2026-03-16 17:18

Severity ?

8.3 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Summary

Missing authorization in the OpenAI thread/message API endpoints of GROWI

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/862.html' target='_blank'></a><ul><li>Missing authorization in the OpenAI thread/message API endpoints (CWE-862) - CVE-2026-25083</li><li>This can be exploited only when an attacker knows a shared AI assistant's identifier</li></ul>Sho Odagiri of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to GROWI, Inc. and coordinated. After the coordination was completed, GROWI, Inc. reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN46373837/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-25083
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000039.html",
  "dc:date": "2026-03-16T17:18+09:00",
  "dcterms:issued": "2026-03-16T17:18+09:00",
  "dcterms:modified": "2026-03-16T17:18+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/862.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authorization in the OpenAI thread/message API endpoints (CWE-862) - CVE-2026-25083\u003c/li\u003e\u003cli\u003eThis can be exploited only when an attacker knows a shared AI assistant\u0027s identifier\u003c/li\u003e\u003c/ul\u003eSho Odagiri of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to GROWI, Inc. and coordinated. After the coordination was completed, GROWI, Inc. reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000039.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.3",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000039",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN46373837/index.html",
      "@id": "JVN#46373837",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-25083",
      "@id": "CVE-2026-25083",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Missing authorization in the OpenAI thread/message API endpoints of GROWI"
}

jvndb-2025-000118

Vulnerability from jvndb

Published

2025-12-17 13:04

Modified

2025-12-17 13:04

Severity ?

4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Summary

GROWI vulnerable to cross-site request forgery

Details

GROWI provided by GROWI, Inc. contains the following vulnerability.<ul><li>Cross-site request forgery (CWE-352) - CVE-2025-64700</li></ul>GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN55745775/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-64700
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000118.html",
  "dc:date": "2025-12-17T13:04+09:00",
  "dcterms:issued": "2025-12-17T13:04+09:00",
  "dcterms:modified": "2025-12-17T13:04+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\u003cul\u003e\u003cli\u003eCross-site request forgery (CWE-352) - CVE-2025-64700\u003c/li\u003e\u003c/ul\u003eGROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000118.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000118",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN55745775/index.html",
      "@id": "JVN#55745775",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-64700",
      "@id": "CVE-2025-64700",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    }
  ],
  "title": "GROWI vulnerable to cross-site request forgery"
}

jvndb-2025-000101

Vulnerability from jvndb

Published

2025-11-06 13:45

Modified

2025-11-06 13:45

Severity ?

5.4 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

GROWI vulnerable to stored cross-site scripting

Details

GROWI provided by GROWI, Inc. contains the following vulnerability. * Stored cross-site scripting (CWE-79) - CVE-2025-61994 Keitaro Yamazaki of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN95942191/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-61994
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000101.html",
  "dc:date": "2025-11-06T13:45+09:00",
  "dcterms:issued": "2025-11-06T13:45+09:00",
  "dcterms:modified": "2025-11-06T13:45+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\r\n\r\n* Stored cross-site scripting (CWE-79) - CVE-2025-61994\r\n\r\nKeitaro Yamazaki of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000101.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.4",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000101",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN95942191/index.html",
      "@id": "JVN#95942191",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-61994",
      "@id": "CVE-2025-61994",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "GROWI vulnerable to stored cross-site scripting"
}

jvndb-2025-000084

Vulnerability from jvndb

Published

2025-10-22 15:44

Modified

2025-10-22 15:44

Severity ?

6.1 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

GROWI vulnerable to cross-site scripting

Details

GROWI provided by GROWI, Inc. contains the following vulnerability. <ul><li>Cross-site scripting in the page alert function (CWE-79) - CVE-2025-54806</li></ul> GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN46526244/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-54806
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000084.html",
  "dc:date": "2025-10-22T15:44+09:00",
  "dcterms:issued": "2025-10-22T15:44+09:00",
  "dcterms:modified": "2025-10-22T15:44+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eCross-site scripting in the page alert function (CWE-79) - CVE-2025-54806\u003c/li\u003e\u003c/ul\u003e\r\nGROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000084.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "6.1",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000084",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN46526244/index.html",
      "@id": "JVN#46526244",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-54806",
      "@id": "CVE-2025-54806",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "GROWI vulnerable to cross-site scripting"
}

jvndb-2025-000042

Vulnerability from jvndb

Published

2025-06-24 15:25

Modified

2025-06-24 15:25

Severity ?

4.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

Inefficient regular expressions in GROWI

Details

GROWI provided by GROWI, Inc. contains the following vulnerability. <ul><li>Inefficient regular expression complexity (CWE-1333) - CVE-2025-43880</li></ul> Takanori Okamoto of FFRI Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN21624250/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-43880
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

GROWI, Inc.

GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000042.html",
  "dc:date": "2025-06-24T15:25+09:00",
  "dcterms:issued": "2025-06-24T15:25+09:00",
  "dcterms:modified": "2025-06-24T15:25+09:00",
  "description": "GROWI provided by GROWI, Inc. contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eInefficient regular expression complexity (CWE-1333) - CVE-2025-43880\u003c/li\u003e\u003c/ul\u003e\r\nTakanori Okamoto of FFRI Security, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000042.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:growi_growi",
    "@product": "GROWI",
    "@vendor": "GROWI, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000042",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN21624250/index.html",
      "@id": "JVN#21624250",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-43880",
      "@id": "CVE-2025-43880",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Inefficient regular expressions in GROWI"
}

CVE-2026-80191 (GCVE-0-2026-80191)

Vulnerability from cvelistv5

Published

2026-08-25 23:18

Modified

2026-08-29 11:48

Severity ?

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Summary

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /attachment/:id and /download/:id, take the attachment identifier from the path, so an unauthenticated caller who has an attachment identifier receives the file regardless of whether the page owning it is private and regardless of whether that caller would be permitted to view the page. Identifiers can be retained by a user whose access was later removed, or recovered from anywhere the identifier was previously exposed. Version 8.0.2 runs the check for authenticated and unauthenticated requests alike, skipping it only where a valid share link has already bound the requested file to that link's page.

References

URL

Tags

	https://github.com/growilabs/growi	product
	https://github.com/growilabs/growi/pull/11756	issue-tracking, patch
	https://github.com/growilabs/growi/blob/v8.0.1/apps/app/src/server/routes/attachment/get.ts	technical-description
	https://github.com/growilabs/growi/releases/tag/v8.0.2	release-notes
	https://www.vulncheck.com/advisories/growi-before-8.0.2-missing-authorization-on-attachment-retrieval-for-unauthenticated-requests	third-party-advisory

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T14:19:33.858679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T14:19:43.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/growilabs/growi",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/growilabs/growi",
          "product": "GROWI",
          "repo": "https://github.com/growilabs/growi",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "lessThan": "8.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:weseek:growi:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dilipkumar Choudhary"
        }
      ],
      "datePublic": "2026-08-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /attachment/:id and /download/:id, take the attachment identifier from the path, so an unauthenticated caller who has an attachment identifier receives the file regardless of whether the page owning it is private and regardless of whether that caller would be permitted to view the page. Identifiers can be retained by a user whose access was later removed, or recovered from anywhere the identifier was previously exposed. Version 8.0.2 runs the check for authenticated and unauthenticated requests alike, skipping it only where a valid share link has already bound the requested file to that link\u0027s page."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T11:48:04.052Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/growilabs/growi"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/growilabs/growi/pull/11756"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/growilabs/growi/blob/v8.0.1/apps/app/src/server/routes/attachment/get.ts"
        },
        {
          "name": "GROWI v8.0.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/growilabs/growi/releases/tag/v8.0.2"
        },
        {
          "name": "VulnCheck Advisory: GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/growi-before-8.0.2-missing-authorization-on-attachment-retrieval-for-unauthenticated-requests"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-80191",
    "datePublished": "2026-08-25T23:18:59.672Z",
    "dateReserved": "2026-08-25T23:10:02.093Z",
    "dateUpdated": "2026-08-29T11:48:04.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41951 (GCVE-0-2026-41951)

Vulnerability from cvelistv5

Published

2026-05-11 09:32

Modified

2026-05-11 12:43

Severity ?

7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper limitation of a pathname to a restricted directory ('Path Traversal')

Summary

Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.

References

URL

Tags

	https://growi.co.jp/news/44/
	https://jvn.jp/jp/JVN38788367/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.5.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T12:42:57.184795Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-11T12:43:07.550Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.5.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T09:32:21.267Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/44/"
        },
        {
          "url": "https://jvn.jp/jp/JVN38788367/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-41951",
    "datePublished": "2026-05-11T09:32:21.267Z",
    "dateReserved": "2026-04-27T08:21:56.914Z",
    "dateUpdated": "2026-05-11T12:43:07.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41040 (GCVE-0-2026-41040)

Vulnerability from cvelistv5

Published

2026-04-23 06:59

Modified

2026-04-23 12:24

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-1333 - Inefficient regular expression complexity

Summary

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

References

URL

Tags

	https://growi.co.jp/news/44/
	https://jvn.jp/en/jp/JVN46728373/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.5.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41040",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-23T12:24:29.141877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-23T12:24:38.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.5.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient regular expression complexity",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-23T06:59:38.451Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/44/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN46728373/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-41040",
    "datePublished": "2026-04-23T06:59:38.451Z",
    "dateReserved": "2026-04-16T08:21:20.314Z",
    "dateUpdated": "2026-04-23T12:24:38.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26291 (GCVE-0-2026-26291)

Vulnerability from cvelistv5

Published

2026-04-15 04:19

Modified

2026-04-15 16:13

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Cross-site scripting (XSS)

Summary

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user's web browser.

References

URL

Tags

	https://growi.co.jp/news/43/
	https://jvn.jp/en/jp/JVN62079296/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.4.6 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T13:32:50.301600Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T16:13:20.770Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.4.6 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-15T04:19:31.678Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/43/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN62079296/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-26291",
    "datePublished": "2026-04-15T04:19:31.678Z",
    "dateReserved": "2026-04-10T06:02:38.943Z",
    "dateUpdated": "2026-04-15T16:13:20.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25083 (GCVE-0-2026-25083)

Vulnerability from cvelistv5

Published

2026-03-16 06:47

Modified

2026-03-16 14:59

Severity ?

8.3 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CWE

CWE-862 - Missing authorization

Summary

GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant's identifier may view and/or tamper the other user's threads/messages.

References

URL

Tags

	https://jvn.jp/en/jp/JVN46373837/
	https://growi.co.jp/news/41/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.4.5 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T14:59:13.916958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T14:59:21.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.4.5 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assistant\u0027s identifier may view and/or tamper the other user\u0027s threads/messages."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing authorization",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-16T06:47:38.734Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://jvn.jp/en/jp/JVN46373837/"
        },
        {
          "url": "https://growi.co.jp/news/41/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-25083",
    "datePublished": "2026-03-16T06:47:38.734Z",
    "dateReserved": "2026-03-12T05:25:12.212Z",
    "dateUpdated": "2026-03-16T14:59:21.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-64700 (GCVE-0-2025-64700)

Vulnerability from cvelistv5

Published

2025-12-17 04:06

Modified

2025-12-17 21:33

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-352 - Cross-site request forgery (CSRF)

Summary

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

References

URL

Tags

	https://growi.co.jp/news/40/
	https://jvn.jp/en/jp/JVN55745775/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v7.3.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:33:05.279502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:33:22.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v7.3.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-17T04:06:08.388Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/40/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN55745775/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-64700",
    "datePublished": "2025-12-17T04:06:08.388Z",
    "dateReserved": "2025-11-10T08:39:24.724Z",
    "dateUpdated": "2025-12-17T21:33:22.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-61994 (GCVE-0-2025-61994)

Vulnerability from cvelistv5

Published

2025-11-06 04:14

Modified

2025-11-06 14:09

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Cross-site scripting (XSS)

Summary

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page.

References

URL

Tags

	https://growi.co.jp/news/39/
	https://jvn.jp/en/jp/JVN95942191/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: prior to v7.2.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-61994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-06T14:09:32.236464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-06T14:09:38.630Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v7.2.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-06T04:14:30.106Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/39/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN95942191/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-61994",
    "datePublished": "2025-11-06T04:14:30.106Z",
    "dateReserved": "2025-10-29T08:38:11.617Z",
    "dateUpdated": "2025-11-06T14:09:38.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-54806 (GCVE-0-2025-54806)

Vulnerability from cvelistv5

Published

2025-10-23 04:10

Modified

2025-10-23 15:05

Severity ?

6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79 - Cross-site scripting (XSS)

Summary

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

References

URL

Tags

	https://growi.co.jp/news/38/
	https://jvn.jp/en/jp/JVN46526244/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: v4.2.7 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-23T15:04:03.231658Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-23T15:05:14.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.2.7 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability  in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-23T04:10:59.281Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/38/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN46526244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-54806",
    "datePublished": "2025-10-23T04:10:59.281Z",
    "dateReserved": "2025-10-15T05:16:42.225Z",
    "dateUpdated": "2025-10-23T15:05:14.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-43880 (GCVE-0-2025-43880)

Vulnerability from cvelistv5

Published

2025-06-25 05:31

Modified

2025-06-25 13:35

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-1333 - Inefficient regular expression complexity

Summary

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.

References

URL

Tags

	https://github.com/weseek/growi/pull/9487
	https://jvn.jp/en/jp/JVN21624250/

Impacted products

	Vendor	Product	Version
	GROWI, Inc.	GROWI	Version: prior to v7.1.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-43880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T13:35:29.026488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-25T13:35:33.651Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v7.1.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient regular expression complexity",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-25T05:31:29.560Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://github.com/weseek/growi/pull/9487"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN21624250/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-43880",
    "datePublished": "2025-06-25T05:31:29.560Z",
    "dateReserved": "2025-06-13T01:56:06.794Z",
    "dateUpdated": "2025-06-25T13:35:33.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Refine your search

18 vulnerabilities found for GROWI by GROWI, Inc.

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

Vulnerability from jvndb

CVE-2026-80191 (GCVE-0-2026-80191)

Vulnerability from cvelistv5

CVE-2026-41951 (GCVE-0-2026-41951)

Vulnerability from cvelistv5

CVE-2026-41040 (GCVE-0-2026-41040)

Vulnerability from cvelistv5

CVE-2026-26291 (GCVE-0-2026-26291)

Vulnerability from cvelistv5

CVE-2026-25083 (GCVE-0-2026-25083)

Vulnerability from cvelistv5

CVE-2025-64700 (GCVE-0-2025-64700)

Vulnerability from cvelistv5

CVE-2025-61994 (GCVE-0-2025-61994)

Vulnerability from cvelistv5

CVE-2025-54806 (GCVE-0-2025-54806)

Vulnerability from cvelistv5

CVE-2025-43880 (GCVE-0-2025-43880)

Vulnerability from cvelistv5