Yamaha Corporation vulnerabilities
Published CVEs affecting Yamaha Corporation products: 7 record(s), with severity, exploitation and fixes.
CVE-2026-97860
Medium · 6.7
CWE-428 Oct 29, 2026
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with…
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
CVE-2026-97854
Critical · 9.8
CWE-78 Oct 29, 2026
OS Command Injection in Yamaha Corporation NWR100
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
CVE-2026-109822
Medium · 6.5
CWE-922 Oct 29, 2026
Insecure Storage of Sensitive Information in Yamaha Corporation NWR100
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.
CVE-2026-103665
High · 7.8
CWE-427 Oct 29, 2026
Uncontrolled Search Path Element in Yamaha Corporation Yamaha LAN Monitor for Windows
The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.
CVE-2026-104679
High · 7.1
CWE-611 Oct 19, 2026
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity...
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.
CVE-2026-76137
Low · 3.3
CWE-306 Aug 21, 2026
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process...
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.
CVE-2026-76131
Medium · 5.3
CWE-798 Aug 21, 2026
Use of Hard-coded Credentials in Yamaha Corporation VOCALOID6
Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.