📊 SecuPortal 日次脆弱性ダイジェスト

2026-07-09 11:01:45 生成 · 2026-07-03〜2026-07-09 (7日分)

新規 KEV 4 | 更新ソフト 12 | 対象期間 7日 | 生成 2026-07-09 11:01:45

📦 更新された主要ソフトウェア

製品	新バージョン	リリース日	CVE件数	Critical	High	状態
Django 6.0	6.0.7	2026-07-07	22	2	7	⚠️要確認
Django 5.2	5.2.16	2026-07-07	22	2	7	⚠️要確認
Jenkins 2	2.572	2026-07-07	16	0	5	🟠重要
Laravel 13	13.19.0	2026-07-07	0	0	0	✅計画
Laravel 12	12.63.0	2026-07-07	0	0	0	✅計画
Postfix 3.11	3.11.5	2026-07-07	0	0	0	✅計画
Postfix 3.10	3.10.12	2026-07-07	0	0	0	✅計画
Postfix 3.9	3.9.13	2026-07-07	0	0	0	✅計画
Postfix 3.8	3.8.19	2026-07-07	0	0	0	✅計画
Postfix 3.7	3.7.21	2026-07-07	0	0	0	✅計画
Postfix 3.6	3.6.19	2026-07-07	0	0	0	✅計画
Postfix 3.5	3.5.26	2026-07-07	0	0	0	✅計画

非主要製品の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）

🔴 ★★★ 要対応 CVE

本日の要対応該当なし。

（Django の Critical CVE（CVE-2026-4277 等、CVSS 9.8/9.1）は主要製品に該当するものの、今回のデータでは attack vector（remote性）が未確認のため、★★★の確定条件を満たさず ★★ 参考に分類しています。公式アドバイザリで remote 性の確認を推奨します。）

🟠 ★★ 参考 CVE

展開して表示 (6件)

CVE-2026-48282 — Adobe ColdFusion (CVSS 10.0, KEV) : KEV登録済みだが自社では ColdFusion を運用していないため直接影響は低いと考えられる。念のため関連ミドルウェアの有無を確認推奨。

CVE-2026-55255 — Langflow (CVSS 9.9, KEV) : KEV登録済みの認可バイパスだが、Langflow は自社主要製品リスト対象外のため影響は限定的である可能性が高い。

CVE-2026-48908 — JoomShaper SP Page Builder (CVSS 不明, KEV) : Joomla系拡張のファイルアップロード脆弱性でKEV登録済みだが、自社での利用実績はないと考えられる。

CVE-2026-56290 — Joomlack Page Builder (CVSS 不明, KEV) : 同様にJoomla系プラグインでKEV登録済み。自社CMS構成に該当製品がないか一応確認しておくと良い。

CVE-2026-4277 — Django 5.2 / 6.0 (CVSS 9.8) : 主要運用対象である Django の Critical 脆弱性。remote性が未確認のため参考ランクだが、CVSSが高いため公式アドバイザリで攻撃条件を早期に確認する価値がある。

CVE-2025-64459 — Django 5.2 / 6.0 (CVSS 9.1) : 同じく Django の Critical 脆弱性。上記CVEと合わせて詳細確認を推奨。

📝 AI 全体サマリ

展開して読む

今週の KEV 新規登録4件はいずれも自社の主要運用対象外（Adobe ColdFusion, Langflow, Joomla系プラグイン2件）であり、自社インフラへの直接影響は低いと考えられます。一方、自社が主要運用対象としている Django が今週2系列（5.2.16 / 6.0.7）同時にセキュリティリリースを行っており、CVE-2026-4277 (CVSS 9.8) を含む Critical 2件・High 7件が含まれるため、優先的な確認対象になり得ます。

Jenkins も High 脆弱性5件を含む更新（2.572）があり、CI/CD 基盤として利用している場合は計画的な適用が望ましい可能性があります。

特記事項として、今回のデータセットには Django の各 CVE について attack vector（remote/local等）情報が含まれておらず、★★★/★★の判定に一部不確実性が残ります。正確なリスク評価のためには、Django 公式セキュリティアドバイザリ（django-security メーリングリスト等）で各 CVE の attack vector と PoC 有無を確認することを推奨します。

CVE-2026-4277 (Django, CVSS 9.8) は影響度が高いため、パッチ適用前に検証環境での動作確認を推奨します。以下は exploit コードではなく、バージョン差分の動作確認用の Docker Compose 骨子の例です。


# docker-compose.verify.yml (骨子例 — 実際のexploitコードは含まない)
services:
  django-current:
    image: python:3.12-slim
    volumes:
      - ./app:/app
    working_dir: /app
    command: >
      sh -c "pip install django==5.2.15 &&
             python manage.py runserver 0.0.0.0:8000"
    ports:
      - "8000:8000"

  django-patched:
    image: python:3.12-slim
    volumes:
      - ./app:/app
    working_dir: /app
    command: >
      sh -c "pip install django==5.2.16 &&
             python manage.py runserver 0.0.0.0:8001"
    ports:
      - "8001:8001"

上記2系統を立てた上で、公式アドバイザリに記載された再現条件（該当エンドポイント・入力パターン等）に基づき、パッチ適用前後の挙動差分を確認する運用を推奨します。

原本データ (JSON) — 表示するにはクリック

{
  "range": {
    "from": "2026-07-03",
    "to": "2026-07-09",
    "days": 7
  },
  "summary": {
    "total_kev_new": 4,
    "total_software_update": 12,
    "by_date": {
      "2026-07-08": {
        "kev_new": 4,
        "software_update": 12
      }
    }
  },
  "kev_new": [
    {
      "digest_date": "2026-07-08",
      "key": "CVE-2026-48282",
      "cve_id": "CVE-2026-48282",
      "vendor_project": "Adobe",
      "product": "ColdFusion",
      "vulnerability_name": "Adobe ColdFusion Path Traversal Vulnerability",
      "date_added": "2026-07-07",
      "short_description": "Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-10",
      "known_ransomware": "Unknown",
      "cvss_score": 10.0,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.",
      "epss_score": 0.01021
    },
    {
      "digest_date": "2026-07-08",
      "key": "CVE-2026-48908",
      "cve_id": "CVE-2026-48908",
      "vendor_project": "JoomShaper",
      "product": "SP Page Builder",
      "vulnerability_name": "JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability",
      "date_added": "2026-07-07",
      "short_description": "JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-10",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.",
      "epss_score": 0.00803
    },
    {
      "digest_date": "2026-07-08",
      "key": "CVE-2026-55255",
      "cve_id": "CVE-2026-55255",
      "vendor_project": "Langflow",
      "product": "Langflow",
      "vulnerability_name": "Langflow Authorization Bypass Through User-Controlled Key Vulnerability",
      "date_added": "2026-07-07",
      "short_description": "Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-10",
      "known_ransomware": "Unknown",
      "cvss_score": 9.9,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.2.",
      "epss_score": 0.00233
    },
    {
      "digest_date": "2026-07-08",
      "key": "CVE-2026-56290",
      "cve_id": "CVE-2026-56290",
      "vendor_project": "Joomlack",
      "product": "Page Builder",
      "vulnerability_name": "Joomlack Page Builder Improper Access Control Vulnerability",
      "date_added": "2026-07-07",
      "short_description": "Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-10",
      "known_ransomware": "Unknown",
      "cvss_score": null,
      "cvss_severity": null,
      "cvss_vector": null,
      "attack_vector": null,
      "is_remote": null,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.",
      "epss_score": 0.00356
    }
  ],
  "software_update": [
    {
      "digest_date": "2026-07-08",
      "key": "django:5.2",
      "product": "django",
      "category": "framework",
      "cycle": "5.2",
      "latest": "5.2.16",
      "release_date": "2025-04-02",
      "latest_release_date": "2026-07-07",
      "eol_date": "2028-04-30",
      "support_date": "2025-12-03",
      "is_major_product": true,
      "cve_stats": {
        "total": 22,
        "critical": 2,
        "high": 7,
        "medium": 6,
        "low": 7,
        "kev": 0,
        "top_cves": [
          {
            "cve_id": "CVE-2026-4277",
            "severity": "CRITICAL",
            "score": 9.8
          },
          {
            "cve_id": "CVE-2025-64459",
            "severity": "CRITICAL",
            "score": 9.1
          },
          {
            "cve_id": "CVE-2025-64460",
            "severity": "HIGH",
            "score": 7.5
          }
        ]
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "django:6.0",
      "product": "django",
      "category": "framework",
      "cycle": "6.0",
      "latest": "6.0.7",
      "release_date": "2025-12-03",
      "latest_release_date": "2026-07-07",
      "eol_date": "2027-04-30",
      "support_date": "2026-08-31",
      "is_major_product": true,
      "cve_stats": {
        "total": 22,
        "critical": 2,
        "high": 7,
        "medium": 6,
        "low": 7,
        "kev": 0,
        "top_cves": [
          {
            "cve_id": "CVE-2026-4277",
            "severity": "CRITICAL",
            "score": 9.8
          },
          {
            "cve_id": "CVE-2025-64459",
            "severity": "CRITICAL",
            "score": 9.1
          },
          {
            "cve_id": "CVE-2025-64460",
            "severity": "HIGH",
            "score": 7.5
          }
        ]
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "jenkins:2",
      "product": "jenkins",
      "category": "devops",
      "cycle": "2",
      "latest": "2.572",
      "release_date": "2016-04-20",
      "latest_release_date": "2026-07-07",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 16,
        "critical": 0,
        "high": 5,
        "medium": 10,
        "low": 1,
        "kev": 0,
        "top_cves": [
          {
            "cve_id": "CVE-2026-33001",
            "severity": "HIGH",
            "score": 8.8
          },
          {
            "cve_id": "CVE-2026-53435",
            "severity": "HIGH",
            "score": 8.8
          },
          {
            "cve_id": "CVE-2026-27099",
            "severity": "HIGH",
            "score": 8.0
          }
        ]
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "laravel:12",
      "product": "laravel",
      "category": "framework",
      "cycle": "12",
      "latest": "12.63.0",
      "release_date": "2025-02-24",
      "latest_release_date": "2026-07-07",
      "eol_date": "2027-02-24",
      "support_date": "2026-08-16",
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "laravel:13",
      "product": "laravel",
      "category": "framework",
      "cycle": "13",
      "latest": "13.19.0",
      "release_date": "2026-03-17",
      "latest_release_date": "2026-07-07",
      "eol_date": "2028-03-17",
      "support_date": "2027-09-30",
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.10",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.10",
      "latest": "3.10.12",
      "release_date": "2025-02-16",
      "latest_release_date": "2026-07-07",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.11",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.11",
      "latest": "3.11.5",
      "release_date": "2026-03-06",
      "latest_release_date": "2026-07-07",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.5",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.5",
      "latest": "3.5.26",
      "release_date": "2020-03-15",
      "latest_release_date": "2026-07-07",
      "eol_date": "2024-03-06",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.6",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.6",
      "latest": "3.6.19",
      "release_date": "2021-04-29",
      "latest_release_date": "2026-07-07",
      "eol_date": "2025-02-16",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.7",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.7",
      "latest": "3.7.21",
      "release_date": "2022-02-06",
      "latest_release_date": "2026-07-07",
      "eol_date": "2026-03-06",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.8",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.8",
      "latest": "3.8.19",
      "release_date": "2023-04-17",
      "latest_release_date": "2026-07-07",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-08",
      "key": "postfix:3.9",
      "product": "postfix",
      "category": "middleware",
      "cycle": "3.9",
      "latest": "3.9.13",
      "release_date": "2024-03-06",
      "latest_release_date": "2026-07-07",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    }
  ]
}