LIFF SDK provided by LY Corporation contains a cross-site scripting vulnerability.

Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. contain hidden functionality issues.

Multiple Tablets provided by Lenovo are shipped with a known private test key for Android Verified Boot.

UnRTF by GNU Project contains an out-of-bounds write vulnerability.

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.

The smartphone application "Vehicle Inspection Certificate Viewer" provided by the Ministry of Land, Infrastructure, Transport and Tourism contains a vulnerability in which sensitive information may be included in data transmitted by the application.

"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability.

"ゲオアプリ" provided by GEO CORPORATION contains multiple vulnerabilities.

EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter

SiteGuard Server Edition provided by EG Secure Solutions Inc. contains an OS command injection vulnerability.

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality.

AssetView provided by Hammock Corporation contains an incorrect permission assignment for critical resource vulnerability.

Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities.