JVN iPedia Q3 2026 Registration Results Published
Overview
The Information-technology Promotion Agency (IPA) reported JVN iPedia registrations for the third quarter of 2026. The Japanese edition added 20,073 records, bringing its total to 310,240; the English edition had 3,346 records cumulatively. CWE-284 was the most common category among registered information, and severity levels 2 and above accounted for 88.4% of CVSSv2 ratings for items registered in 2026. Applications were the largest product category. All 20 most-accessed items were information published by JVN.
Key points
- The Japanese edition registered 20,073 items in the third quarter, bringing its cumulative total to 310,240.
- CWE-284 was the most common registered vulnerability category, with 1,580 items.
- Among items registered in 2026, CVSSv2 severity level 2 or higher accounted for 88.4%.
- All 20 most-accessed items were information published by JVN.
Overview
JVN iPedia is a database that has published software vulnerability information in Japanese since April 25, 2007. It gathers and translates information from domestic software developers, JVN, Japan’s vulnerability information portal, and the U.S. National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), enabling system administrators to respond quickly.
The reporting period, the third quarter of 2026, ran from July 1 through September 30, 2026. The article covers registration status, classifications of registered data, registrations by product, and use of the information.
Details
Of the 20,073 Japanese-edition registrations in the third quarter, 13 came from domestic product developers, 147 from JVN, and 19,913 from NVD. The English edition registered 76 items, bringing its cumulative total to 3,346.
The leading CWE categories were CWE-284 (Improper Access Control), 1,580 items; CWE-416 (Use After Free), 938; CWE-122 (Heap-based Buffer Overflow), 684; CWE-125 (Out-of-bounds Read), 602; and CWE-20 (Improper Input Validation), 522. If exploited, CWE-284 may lead to information disclosure or tampering, or denial of service.
For items registered in 2026, CVSSv2 ratings were level 3 at 44.1%, level 2 at 44.3%, and level 1 at 11.6%. CVSSv3 ratings were Critical at 13.6%, High at 44.2%, Medium at 39.6%, and Low at 2.5%. The report attributes the sharp decline in CVSSv2 registrations since 2024 to NVD, its information source, no longer actively assigning CVSSv2 ratings.
By product type in 2026, applications accounted for 28,703 of 38,515 items, approximately 74.5%.
For Q3 registrations by product, Microsoft Windows 11 ranked first with 4,278 items, Windows 10 second with 4,029, and Qualcomm component third with 2,737. Users and developers are encouraged to obtain information about software used in their organizations and use it to guide countermeasures.
IPA calls on product developers to work to reduce vulnerabilities from the planning and design stages, and publishes a developer guide, guidance on building secure websites, and AppGoat, a vulnerability learning tool. It also urges developers to monitor new information and promptly upgrade or update products to versions in which vulnerabilities have been fixed. Newly registered information is also published in RSS and XML formats.
All 20 most-accessed items were vulnerability information published by JVN. Among the most-accessed information collected from domestic product developers, information related to the SVP for Hitachi disk array systems ranked first, with 3,422 accesses.