Vulnerability Countermeasure Information Database JVN iPedia Registration Status [2026 2nd Quarter (Apr. - Jun.)]

1. 2026 2nd Quarter: Vulnerability Countermeasure Information Database JVN iPedia Registration Status

The vulnerability countermeasure information database JVN iPedia is endeavoring to become a comprehensive vulnerability database where vulnerability countermeasure information is aggregated for easy access for IT users. JVN iPedia collects and/or translates the vulnerability countermeasure information published by 1) domestic software developers, 2) JVN (footnote 1), a vulnerability countermeasure information portal run by JPCERT/CC and IPA, and 3) NVD (footnote 2), a vulnerability database run by NIST (footnote 3). JVN iPedia has been making vulnerability countermeasure information available to the public since April 25, 2007.

1-1. Vulnerabilities Registered in the 2nd Quarter of 2026

JVN iPedia now stores 290,167 vulnerabilities

The summary of the vulnerability countermeasure information registered to the Japanese version of JVN iPedia during the second quarter (April 1 to June 30) of 2026 is shown in the table below. As of the end of June 2026, the total number of vulnerabilities stored in JVN iPedia is 290,167 (Table 1-1, Figure 1-1).

As for the JVN iPedia English version, the total number of vulnerabilities stored is 3,270 as shown in the Table 1-2.

Table 1-1. Vulnerabilities Registered in JVN iPedia in the 2nd Quarter of 2026 (Japanese Version)

Table 1-2. Vulnerabilities Registered in JVN iPedia in the 2nd Quarter of 2026 (English Version)

2. Details on JVN iPedia Registered Data

2-1. Types of Vulnerabilities Reported

Figure 2-1 shows the number of vulnerabilities newly added to JVN iPedia during the second quarter (April 1 to June 30) of 2026, sorted by the CWE vulnerability types.

The most frequently reported vulnerability type in the first quarter is CWE-416 (Use After Free) with 749 cases, followed by CWE-79 (Cross-site Scripting) with 697 cases, CWE-20 (Improper Input Validation) with 445 cases, CWE-125 (Out-of-bounds Read) with 413 cases, and CWE-284 (Improper Access Control) with 398 cases. CWE-416 (Use After Free), the most commonly reported vulnerability type in this quarter, may allow attackers to exfiltrate or modify information and cause denial-of-service (DoS) conditions if successfully exploited.

Software developers need to make sure to mitigate vulnerability from the planning and design phase of software development. IPA provides tools and guidelines, such as “Vulnerability Countermeasure Guide for Software Developers” (footnote 4), “How to Secure Your Web-site” (footnote 5), and “AppGoat” (footnote 6), a hands-on venerability learning tool, for website developers and operators to build secure websites.

Footnotes

 (1) Japan Vulnerability Notes: A portal for vulnerability countermeasure information including information on vendor response to the reported vulnerabilities and security support. Operated in the collaboration of IPA and JPCERT/CC.

 (2) National Vulnerability Database: A vulnerability database operated by NIST.

 (3) National Institute of Standards and Technology: A U.S federal agency that develops and promotes measurement, standards and technology.

 (4) Vulnerability Countermeasure Guide for Software Developers (in Japanese only)

 (5) How to Secure Your Websites (latest version in Japanese only)

 (6) AppGoat (in Japanese only)

Download

• For more details, please download the full report below.
• Vulnerability Countermeasure Information Database JVN iPedia Registration Status [2026 2nd Quarter (April – June)](PDF:861 KB)

Past Quarterly Reports

• Quarterly Reports of the JVN iPedia Registration Status