📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 9
|
更新ソフト 6
|
対象期間 7日
|
生成 2026-07-22 17:51:15
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| WordPress 6.8 系 | 6.8.6 | 2026-07-17 | 0 | 0 | 0 | 0 | ✅計画 |
| WordPress 6.9 系 | 6.9.5 | 2026-07-17 | 0 | 0 | 0 | 0 | ✅計画 |
| WordPress 7.0 系 | 7.0.2 | 2026-07-17 | 0 | 0 | 0 | 0 | ✅計画 |
| Ruby 3.3 系 | 3.3.12 | 2026-07-16 | 0 | 0 | 0 | 0 | ✅計画 |
| Rust 1.97 系 | 1.97.1 | 2026-07-16 | 0 | 0 | 0 | 0 | ✅計画 |
| Vue.js 3.5 系 | 3.5.40 | 2026-07-16 | 0 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
🟠 ★★ 参考 CVE
展開して表示 (9件)
📝 AI 全体サマリ
展開して読む
# docker-compose.yml (検証用スケルトン)
services:
db:
image: mysql:8.0
environment:
MYSQL_ROOT_PASSWORD: example
MYSQL_DATABASE: wordpress
wordpress:
image: wordpress:6.8.6 # 検証対象バージョンに合わせて変更
depends_on:
- db
environment:
WORDPRESS_DB_HOST: db
WORDPRESS_DB_NAME: wordpress
ports:
- "8080:80"
上記で該当バージョンを起動し、公式アドバイザリに記載された影響条件（プラグイン/テーマの入力処理経路など）を確認する形が想定される。実際の検証は社内ルールに従い、許可された検証環境でのみ実施することを推奨。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-07-16",
"to": "2026-07-22",
"days": 7
},
"summary": {
"total_kev_new": 9,
"total_software_update": 6,
"by_date": {
"2026-07-22": {
"kev_new": 4,
"software_update": 0
},
"2026-07-18": {
"kev_new": 0,
"software_update": 3
},
"2026-07-17": {
"kev_new": 3,
"software_update": 3
},
"2026-07-16": {
"kev_new": 2,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-07-22",
"key": "CVE-2021-27137",
"cve_id": "CVE-2021-27137",
"vendor_project": "DD-WRT",
"product": "DD-WRT",
"vulnerability_name": "DD-WRT Stack-Based Buffer Overflow Vulnerability",
"date_added": "2026-07-21",
"short_description": "DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-24",
"known_ransomware": "Unknown",
"cvss_score": 8.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).",
"epss_score": 0.05447
},
{
"digest_date": "2026-07-22",
"key": "CVE-2026-0770",
"cve_id": "CVE-2026-0770",
"vendor_project": "Langflow",
"product": "Langflow",
"vulnerability_name": "Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
"date_added": "2026-07-21",
"short_description": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-24",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can le",
"epss_score": 0.10371
},
{
"digest_date": "2026-07-22",
"key": "CVE-2026-60137",
"cve_id": "CVE-2026-60137",
"vendor_project": "WordPress",
"product": "Core",
"vulnerability_name": "WordPress Core SQL Injection Vulnerability",
"date_added": "2026-07-21",
"short_description": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-04",
"known_ransomware": "Unknown",
"cvss_score": 5.9,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.",
"epss_score": 0.04026
},
{
"digest_date": "2026-07-22",
"key": "CVE-2026-63030",
"cve_id": "CVE-2026-63030",
"vendor_project": "WordPress",
"product": "Core",
"vulnerability_name": "WordPress Core Interpretation Conflict Vulnerability",
"date_added": "2026-07-21",
"short_description": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-24",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.",
"epss_score": 0.08946
},
{
"digest_date": "2026-07-17",
"key": "CVE-2026-25089",
"cve_id": "CVE-2026-25089",
"vendor_project": "Fortinet",
"product": "FortiSandbox",
"vulnerability_name": "Fortinet FortiSandbox OS Command Injection Vulnerability",
"date_added": "2026-07-16",
"short_description": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-19",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",
"epss_score": 0.23393
},
{
"digest_date": "2026-07-17",
"key": "CVE-2026-39808",
"cve_id": "CVE-2026-39808",
"vendor_project": "Fortinet",
"product": "FortiSandbox",
"vulnerability_name": "Fortinet FortiSandbox OS Command Injection Vulnerability",
"date_added": "2026-07-16",
"short_description": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-19",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>",
"epss_score": 0.48668
},
{
"digest_date": "2026-07-17",
"key": "CVE-2026-58644",
"cve_id": "CVE-2026-58644",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
"date_added": "2026-07-16",
"short_description": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-19",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.01296
},
{
"digest_date": "2026-07-16",
"key": "CVE-2023-4346",
"cve_id": "CVE-2023-4346",
"vendor_project": "KNX Association",
"product": "KNX Protocol Connection Authorization Option 1",
"vulnerability_name": "KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability",
"date_added": "2026-07-15",
"short_description": "KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-29",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-07-16",
"key": "CVE-2026-46817",
"cve_id": "CVE-2026-46817",
"vendor_project": "Oracle",
"product": "E-Business Suite",
"vulnerability_name": "Oracle E-Business Suite Improper Privilege Management Vulnerability",
"date_added": "2026-07-15",
"short_description": "Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-18",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C",
"epss_score": 0.00677
}
],
"software_update": [
{
"digest_date": "2026-07-18",
"key": "wordpress:6.8",
"product": "wordpress",
"category": "cms",
"cycle": "6.8",
"latest": "6.8.6",
"release_date": "2025-04-15",
"latest_release_date": "2026-07-17",
"eol_date": "2025-12-02",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-18",
"key": "wordpress:6.9",
"product": "wordpress",
"category": "cms",
"cycle": "6.9",
"latest": "6.9.5",
"release_date": "2025-12-02",
"latest_release_date": "2026-07-17",
"eol_date": "2026-05-20",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-18",
"key": "wordpress:7.0",
"product": "wordpress",
"category": "cms",
"cycle": "7.0",
"latest": "7.0.2",
"release_date": "2026-05-20",
"latest_release_date": "2026-07-17",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-17",
"key": "ruby:3.3",
"product": "ruby",
"category": "programming",
"cycle": "3.3",
"latest": "3.3.12",
"release_date": "2023-12-25",
"latest_release_date": "2026-07-16",
"eol_date": "2027-03-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-17",
"key": "rust:1.97",
"product": "rust",
"category": "programming",
"cycle": "1.97",
"latest": "1.97.1",
"release_date": "2026-07-09",
"latest_release_date": "2026-07-16",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-17",
"key": "vue:3.5",
"product": "vue",
"category": "framework",
"cycle": "3.5",
"latest": "3.5.40",
"release_date": "2024-09-03",
"latest_release_date": "2026-07-16",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
}
]
}