Movable Type provided by Six Apart Ltd. contains multiple vulnerabilities listed below:<a href='https://cwe.mitre.org/data/definitions/94.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/89.html' target='_blank'></a> <ul><li>Code Injection in the Upgrade Script (CWE-94) - CVE-2026-96408</li><li>SQL Injection in the Site Search function (CWE-89) - CVE-2026-103668</li></ul> In addition, multiple vulnerabilities have been addressed. For details, refer to the information provided by the developer. RyotaK of GMO Flatt Security Inc. reported these vulnerabilities to the developer and coordinated. After the coordination was completed, the developer reported the case to JPCERT/CC to notify users of the solution through JVN.

Android application "Ticket Ryutsu Center" provided by Wavedash Co., Ltd. contains multiple vulnerabilities listed below:<a href='https://cwe.mitre.org/data/definitions/798.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/939.html' target='_blank'></a><ul><li>Use of Hard-coded Credentials (CWE-798) - CVE-2026-92861</li><li>Improper Authorization in Handler for Custom URL Scheme (CWE-939) - CVE-2026-92862</li></ul>Koki Sato of BroadBand Security, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Universal Library for Linux (uldaq) provided by Measurement Computing Corporation contains the following vulnerability:<a href='https://cwe.mitre.org/data/definitions/121.html' target='_blank'></a><a href='https://www.cve.org/CVERecord?id=CVE-2026-19477' target='_blank'></a><ul><li>Stack-based Buffer Overflow (CWE-121) - CVE-2026-19477</li></ul>Tsurumi Junichi of Panasonic Holdings Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

GROWI provided by GROWI, Inc. contains the following vulnerability:<a href='https://cwe.mitre.org/data/definitions/552.html' target='_blank'></a><ul><li>Files or Directories Accessible to External Parties (CWE-552) - CVE-2026-100727</li></ul>GROWI, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and GROWI, Inc. coordinated under the Information Security Early Warning Partnership.

Hitachi Coding Software Suite (hereinafter referred to as "HCSS") contains multiple vulnerabilities. Michael Heinzl reported these vulnerabilities.

Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Sharp Corporation contain a path traversal vulnerability.<a href='https://cwe.mitre.org/data/definitions/22.html' target='_blank'></a><ul><li>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) - CVE-2026-78249</li></ul>FUJIFILM Business Innovation Corp. reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. JPCERT/CC coordinated with FUJIFILM Business Innovation Corp. and Sharp Corporation.

Image Scanner Driver for Linux provided by PFU Limited contains multiple vulnerabilities listed below:<a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/59.html' target='_blank'></a><ul><li>OS Command Injection (CWE-78) - CVE-2026-78229</li><li>Link Following (CWE-59) - CVE-2026-81310</li></ul>Nir Yehoshua of Cipher Security Labs reported these vulnerabilities to PFU Limited and coordinated. After the coordination was completed, PFU Limited reported the case to JPCERT/CC to notify users of the solution through JVN.

Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below:<a href='https://cwe.mitre.org/data/definitions/787.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/295.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/787.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/121.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/476.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/532.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/303.html' target='_blank'></a><ul><li>Out-of-bounds Write (CWE-787) - CVE-2026-92867</li><li>Improper Certificate Validation (CWE-295) - CVE-2026-92868</li><li>Out-of-bounds Write (CWE-787) - CVE-2026-92869</li><li>Stack-based Buffer Overflow (CWE-121) - CVE-2026-92870</li><li>NULL Pointer Dereference (CWE-476) - CVE-2026-92871</li><li>Insertion of Sensitive Information into Log File (CWE-532) - CVE-2026-92872</li><li>Incorrect Implementation of Authentication Algorithm (CWE-303) - CVE-2026-92873</li></ul>Emond Papegaaij of Topicus Security reported these vulnerabilities to Pgpool Global Development Group and coordinated. Pgpool Global Development Group and JPCERT/CC published respective advisories in order to notify users of this vulnerability.

The web configuration user interfaces of Wi-Fi products provided by BUFFALO INC. contain multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/121.html' target='_blank'></a><ul><li>OS command injection (CWE-78) - CVE-2026-86530</li><li>Stack-based buffer overflow (CWE-121) - CVE-2026-95104</li></ul>Veeti Punnonen reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.

CONPROSYS series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/548.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/1395.html' target='_blank'></a><a href='https://www.cve.org/CVERecord?id=CVE-2020-7746' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/434.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/787.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/352.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/256.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/306.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/121.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/522.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/306.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/95.html' target='_blank'></a><ul><li>Cross-site scripting (CWE-79) - CVE-2026-82773, CVE-2026-82776, CVE-2026-82788</li><li>OS command injection (CWE-78) - CVE-2026-82774, CVE-2026-82777, CVE-2026-82779</li><li>Exposure of information through directory listing (CWE-548…