📊 SecuPortal 日次脆弱性ダイジェスト

2026-07-23 14:48:20 生成 · 2026-07-17〜2026-07-23 (7日分)

新規 KEV 7 | 更新ソフト 6 | 対象期間 7日 | 生成 2026-07-23 14:48:20

📦 更新された主要ソフトウェア

製品	新バージョン	リリース日	状態
wordpress (6.8系)	6.8.6	2026-07-17	✅計画
wordpress (6.9系)	6.9.5	2026-07-17	✅計画
wordpress (7.0系)	7.0.2	2026-07-17	✅計画
ruby (3.3系)	3.3.12	2026-07-16	✅計画
rust (1.97系)	1.97.1	2026-07-16	✅計画
vue (3.5系)	3.5.40	2026-07-16	✅計画

非主要製品の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）

🔴 ★★★ 要対応 CVE

本日の要対応該当なし

🟠 ★★ 参考 CVE

展開して表示 (7件)

CVE-2021-27137 — DD-WRT (CVSS 8.1, KEV) : 家庭用/組込みルーター向けOSSで、自社インフラでは非採用の可能性が高く影響は低いと考えられる。

CVE-2026-0770 — Langflow (CVSS 9.8, KEV) : LLMワークフロー構築ツールで自社の運用対象OSSには含まれていないと思われるが、社内で検証用途などに導入されていないか一応確認しておくと安心。

CVE-2026-60137 — WordPress Core (CVSS 5.9, KEV) : SQLi単体の深刻度は中程度だが、CVE-2026-63030と連鎖するとRCEに至る可能性がある。自社でWordPressを運用している場合はプラグイン/テーマ経由の入力経路を公式アドバイザリで確認する必要がある。

CVE-2026-63030 — WordPress Core (CVSS 9.8, KEV) : 上記CVE-2026-60137との連鎖でRCEに至る可能性がある。データ上はis_major_productがfalse扱いだが、自社の実際のWordPress運用状況と照合し優先度を再評価する余地がある。

CVE-2026-25089 — Fortinet FortiSandbox (CVSS 9.8, KEV) : サンドボックス専用アプライアンスで自社では未使用と想定されるため影響は低いと考えられる。

CVE-2026-39808 — Fortinet FortiSandbox (CVSS 9.8, KEV) : 同ベンダー・同製品の別のOSコマンドインジェクション。自社未使用のため影響は低いと考えられる。

CVE-2026-58644 — Microsoft SharePoint (CVSS 9.8, KEV) : エンタープライズ製品で自社の主な運用対象外だが、SharePoint OnlineテナントやSharePoint Server利用有無については念のため確認しておくと良い。

📝 AI 全体サマリ

展開して読む

今週のKEV新規追加は、DD-WRT・Fortinet FortiSandbox・Microsoft SharePoint・Langflowなど、自社の主要運用対象OSS（nginx/Django/Next.js/PostgreSQL/Log4j等）とは重ならないエンタープライズ機器・組込み系製品が中心だった可能性がある。

一方でWordPress Core関連のCVE-2026-60137とCVE-2026-63030は連鎖するとSQLi→RCEに至る可能性があり、データ上はis_major_product=falseとなっているものの、自社ソフトウェア更新情報側にはWordPress(6.8/6.9/7.0系)が主要製品として登録されているため、実運用の有無を公式アドバイザリと合わせて再確認する価値があると考えられる。

主要製品側(wordpress/ruby/rust/vue)の更新はいずれもCVE件数0件であり、今回は通常のバージョンリリース対応の範囲と考えられる。

PoC検証を推奨するとすれば、自社でWordPressを運用している場合に限りCVE-2026-60137 / CVE-2026-63030の検証環境構築が有用と考えられる。あくまで骨子のみで、実際のexploitコードは含めていない。


# 検証用 docker-compose 骨子（イメージタグは実際の脆弱バージョンを公式アドバイザリで確認して指定すること）
version: "3.8"
services:
  wordpress:
    image: wordpress:<検証対象バージョン>
    ports:
      - "8080:80"
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wp
      WORDPRESS_DB_PASSWORD: changeme
    depends_on:
      - db
  db:
    image: mysql:8.0
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wp
      MYSQL_PASSWORD: changeme
      MYSQL_ROOT_PASSWORD: changeme

この環境は隔離されたネットワーク内でのみ起動し、外部到達性を持たせないことを推奨する。

原本データ (JSON) — 表示するにはクリック

{
  "range": {
    "from": "2026-07-17",
    "to": "2026-07-23",
    "days": 7
  },
  "summary": {
    "total_kev_new": 7,
    "total_software_update": 6,
    "by_date": {
      "2026-07-22": {
        "kev_new": 4,
        "software_update": 0
      },
      "2026-07-18": {
        "kev_new": 0,
        "software_update": 3
      },
      "2026-07-17": {
        "kev_new": 3,
        "software_update": 3
      }
    }
  },
  "kev_new": [
    {
      "digest_date": "2026-07-22",
      "key": "CVE-2021-27137",
      "cve_id": "CVE-2021-27137",
      "vendor_project": "DD-WRT",
      "product": "DD-WRT",
      "vulnerability_name": "DD-WRT Stack-Based Buffer Overflow Vulnerability",
      "date_added": "2026-07-21",
      "short_description": "DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-24",
      "known_ransomware": "Unknown",
      "cvss_score": 8.1,
      "cvss_severity": "HIGH",
      "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).",
      "epss_score": 0.05447
    },
    {
      "digest_date": "2026-07-22",
      "key": "CVE-2026-0770",
      "cve_id": "CVE-2026-0770",
      "vendor_project": "Langflow",
      "product": "Langflow",
      "vulnerability_name": "Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
      "date_added": "2026-07-21",
      "short_description": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-24",
      "known_ransomware": "Unknown",
      "cvss_score": 9.8,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can le",
      "epss_score": 0.10371
    },
    {
      "digest_date": "2026-07-22",
      "key": "CVE-2026-60137",
      "cve_id": "CVE-2026-60137",
      "vendor_project": "WordPress",
      "product": "Core",
      "vulnerability_name": "WordPress Core SQL Injection Vulnerability",
      "date_added": "2026-07-21",
      "short_description": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-08-04",
      "known_ransomware": "Unknown",
      "cvss_score": 5.9,
      "cvss_severity": "MEDIUM",
      "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.",
      "epss_score": 0.04026
    },
    {
      "digest_date": "2026-07-22",
      "key": "CVE-2026-63030",
      "cve_id": "CVE-2026-63030",
      "vendor_project": "WordPress",
      "product": "Core",
      "vulnerability_name": "WordPress Core Interpretation Conflict Vulnerability",
      "date_added": "2026-07-21",
      "short_description": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-24",
      "known_ransomware": "Unknown",
      "cvss_score": 9.8,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.",
      "epss_score": 0.08946
    },
    {
      "digest_date": "2026-07-17",
      "key": "CVE-2026-25089",
      "cve_id": "CVE-2026-25089",
      "vendor_project": "Fortinet",
      "product": "FortiSandbox",
      "vulnerability_name": "Fortinet FortiSandbox OS Command Injection Vulnerability",
      "date_added": "2026-07-16",
      "short_description": "Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-19",
      "known_ransomware": "Unknown",
      "cvss_score": 9.8,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests",
      "epss_score": 0.23393
    },
    {
      "digest_date": "2026-07-17",
      "key": "CVE-2026-39808",
      "cve_id": "CVE-2026-39808",
      "vendor_project": "Fortinet",
      "product": "FortiSandbox",
      "vulnerability_name": "Fortinet FortiSandbox OS Command Injection Vulnerability",
      "date_added": "2026-07-16",
      "short_description": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-19",
      "known_ransomware": "Unknown",
      "cvss_score": 9.8,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>",
      "epss_score": 0.48668
    },
    {
      "digest_date": "2026-07-17",
      "key": "CVE-2026-58644",
      "cve_id": "CVE-2026-58644",
      "vendor_project": "Microsoft",
      "product": "SharePoint",
      "vulnerability_name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability",
      "date_added": "2026-07-16",
      "short_description": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "due_date": "2026-07-19",
      "known_ransomware": "Unknown",
      "cvss_score": 9.8,
      "cvss_severity": "CRITICAL",
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "attack_vector": "N",
      "is_remote": true,
      "is_major_product": false,
      "matched_product": null,
      "title_en": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
      "epss_score": 0.01296
    }
  ],
  "software_update": [
    {
      "digest_date": "2026-07-18",
      "key": "wordpress:6.8",
      "product": "wordpress",
      "category": "cms",
      "cycle": "6.8",
      "latest": "6.8.6",
      "release_date": "2025-04-15",
      "latest_release_date": "2026-07-17",
      "eol_date": "2025-12-02",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-18",
      "key": "wordpress:6.9",
      "product": "wordpress",
      "category": "cms",
      "cycle": "6.9",
      "latest": "6.9.5",
      "release_date": "2025-12-02",
      "latest_release_date": "2026-07-17",
      "eol_date": "2026-05-20",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-18",
      "key": "wordpress:7.0",
      "product": "wordpress",
      "category": "cms",
      "cycle": "7.0",
      "latest": "7.0.2",
      "release_date": "2026-05-20",
      "latest_release_date": "2026-07-17",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-17",
      "key": "ruby:3.3",
      "product": "ruby",
      "category": "programming",
      "cycle": "3.3",
      "latest": "3.3.12",
      "release_date": "2023-12-25",
      "latest_release_date": "2026-07-16",
      "eol_date": "2027-03-31",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-17",
      "key": "rust:1.97",
      "product": "rust",
      "category": "programming",
      "cycle": "1.97",
      "latest": "1.97.1",
      "release_date": "2026-07-09",
      "latest_release_date": "2026-07-16",
      "eol_date": "false",
      "support_date": null,
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    },
    {
      "digest_date": "2026-07-17",
      "key": "vue:3.5",
      "product": "vue",
      "category": "framework",
      "cycle": "3.5",
      "latest": "3.5.40",
      "release_date": "2024-09-03",
      "latest_release_date": "2026-07-16",
      "eol_date": "false",
      "support_date": "true",
      "is_major_product": true,
      "cve_stats": {
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "kev": 0,
        "top_cves": []
      }
    }
  ]
}