A vulnerability detection device comprising: an extracting unit that extracts a first program code corresponding to an uncorrected vulnerability portion of software; a normalization processing unit that normalizes a parameter varying depending on compilation environment, among parameters included in the first program code extracted by the extracting unit and in a second program code of software as a target to be tested for the vulnerability portion; a similarity calculating unit that calculates a first similarity which is a similarity of an arbitrary portion of the second program code after normalization as a comparison target to the first program code; a determining unit that refers to vulnerability related information for a portion of the second program code in which the calculated first similarity exceeds a predetermined threshold, and that determines whether the portion of the second program code is an unknown vulnerability portion; and an output unit that outputs the portion of the second program code determined as the unknown vulnerability portion, characterized in that the similarity calculating unit adds, when calculating the first similarity, a first value for a portion of a character string same as a character string of the first program code in the second program code after normalization, adds a second value lower than the first value for a portion of a character string different from the character string of the first program code, and, when there is a section in which the character string different from that of the first program code is inserted into the second program code after normalization or when there is a section in which character strings of the first program code are partially deleted, adds a third value lower than the second value for a character string at a starting point of the section, and adds a fourth value which is higher than the third value and lower than 0 for a character string at a continuing point of the section. an extracting unit that extracts a first program code corresponding to an uncorrected vulnerability portion of software; a normalization processing unit that normalizes a parameter varying depending on compilation environment, among parameters included in the first program code extracted by the extracting unit and in a second program code of software as a target to be tested for the vulnerability portion; a similarity calculating unit that calculates a first similarity which is a similarity of an arbitrary portion of the second program code after normalization as a comparison target to the first program code; a determining unit that refers to vulnerability related information for a portion of the second program code in which the calculated first similarity exceeds a predetermined threshold, and that determines whether the portion of the second program code is an unknown vulnerability portion; and an output unit that outputs the portion of the second program code determined as the unknown vulnerability portion, characterized in that the similarity calculating unit adds, when calculating the first similarity, a first value for a portion of a character string same as a character string of the first program code in the second program code after normalization, adds a second value lower than the first value for a portion of a character string different from the character string of the first program code, and, when there is a section in which the character string different from that of the first program code is inserted into the second program code after normalization or when there is a section in which character strings of the first program code are partially deleted, adds a third value lower than the second value for a character string at a starting point of the section, and adds a fourth value which is higher than the third value and lower than 0 for a character string at a continuing point of the section.