Core Temp kernel driver provided by ALCPU is vulnerable to exposed IOCTL with insufficient access control.

Apache Struts 2 REST Plugin provided by The Apache Software Foundation contains an issue that @StrutsParameter authorization does not apply to Jackson @JsonAnySetter members.

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains multiple vulnerabilities.

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries.

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths.

GROWI provided by GROWI, Inc. contains multiple vulnerabilities.

Sleipnir Mobile for Android provided by Fenrir Inc. contains a user interface misrepresentation of critical information vulnerability.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains multiple vulnerabilities.

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability.

LDAP authentication of Pleasanter contains an authentication bypass vulnerability.

LIFF SDK provided by LY Corporation contains a cross-site scripting vulnerability.

Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. contain hidden functionality issues.

Multiple Tablets provided by Lenovo are shipped with a known private test key for Android Verified Boot.

UnRTF by GNU Project contains an out-of-bounds write vulnerability.

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.

The smartphone application "Vehicle Inspection Certificate Viewer" provided by the Ministry of Land, Infrastructure, Transport and Tourism contains a vulnerability in which sensitive information may be included in data transmitted by the application.

"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability.

"ゲオアプリ" provided by GEO CORPORATION contains multiple vulnerabilities.

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

SiteGuard Server Edition provided by EG Secure Solutions Inc. contains an OS command injection vulnerability.