📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 6
|
更新ソフト 6
|
対象期間 7日
|
生成 2026-07-25 14:23:39
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| drupal (10.6) | 10.6.14 | 2026-07-23 | 7 | 0 | 0 | 0 | ✅計画 |
| drupal (11.3) | 11.3.16 | 2026-07-23 | 7 | 0 | 0 | 0 | ✅計画 |
| nextcloud (32) | 32.0.13 | 2026-07-23 | 0 | 0 | 0 | 0 | ✅計画 |
| nextcloud (33) | 33.0.7 | 2026-07-23 | 0 | 0 | 0 | 0 | ✅計画 |
| nextcloud (34) | 34.0.2 | 2026-07-23 | 0 | 0 | 0 | 0 | ✅計画 |
| rabbitmq (4.3) | 4.3.4 | 2026-07-23 | 0 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
🟠 ★★ 参考 CVE
展開して表示 (6件)
📝 AI 全体サマリ
展開して読む
# docker-compose.yml (検証用・隔離ネットワーク推奨)
version: "3.8"
services:
wordpress:
image: wordpress:latest
environment:
WORDPRESS_DB_HOST: db
WORDPRESS_DB_USER: wp
WORDPRESS_DB_PASSWORD: wp_pass
WORDPRESS_DB_NAME: wordpress
ports:
- "8080:80"
depends_on:
- db
db:
image: mariadb:latest
environment:
MYSQL_ROOT_PASSWORD: root_pass
MYSQL_DATABASE: wordpress
MYSQL_USER: wp
MYSQL_PASSWORD: wp_pass
上記は隔離環境（インターネット非接続のホストオンリーネットワーク等）での検証を前提とし、実際の攻撃コードは含めず、公式アドバイザリのPoC情報を参照しながら影響範囲を確認する用途に限定することを推奨する。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-07-19",
"to": "2026-07-25",
"days": 7
},
"summary": {
"total_kev_new": 6,
"total_software_update": 6,
"by_date": {
"2026-07-24": {
"kev_new": 0,
"software_update": 6
},
"2026-07-23": {
"kev_new": 2,
"software_update": 0
},
"2026-07-22": {
"kev_new": 4,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-07-23",
"key": "CVE-2026-16232",
"cve_id": "CVE-2026-16232",
"vendor_project": "Check Point",
"product": "SmartConsole",
"vulnerability_name": "Check Point SmartConsole Improper Authentication Vulnerability",
"date_added": "2026-07-22",
"short_description": "Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-25",
"known_ransomware": "Unknown",
"cvss_score": 9.1,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this",
"epss_score": null
},
{
"digest_date": "2026-07-23",
"key": "CVE-2026-50522",
"cve_id": "CVE-2026-50522",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ",
"date_added": "2026-07-22",
"short_description": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-25",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.20346
},
{
"digest_date": "2026-07-22",
"key": "CVE-2021-27137",
"cve_id": "CVE-2021-27137",
"vendor_project": "DD-WRT",
"product": "DD-WRT",
"vulnerability_name": "DD-WRT Stack-Based Buffer Overflow Vulnerability",
"date_added": "2026-07-21",
"short_description": "DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-24",
"known_ransomware": "Unknown",
"cvss_score": 8.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).",
"epss_score": 0.05447
},
{
"digest_date": "2026-07-22",
"key": "CVE-2026-0770",
"cve_id": "CVE-2026-0770",
"vendor_project": "Langflow",
"product": "Langflow",
"vulnerability_name": "Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
"date_added": "2026-07-21",
"short_description": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-24",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can le",
"epss_score": 0.10371
},
{
"digest_date": "2026-07-22",
"key": "CVE-2026-60137",
"cve_id": "CVE-2026-60137",
"vendor_project": "WordPress",
"product": "Core",
"vulnerability_name": "WordPress Core SQL Injection Vulnerability",
"date_added": "2026-07-21",
"short_description": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-04",
"known_ransomware": "Unknown",
"cvss_score": 5.9,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.",
"epss_score": 0.04026
},
{
"digest_date": "2026-07-22",
"key": "CVE-2026-63030",
"cve_id": "CVE-2026-63030",
"vendor_project": "WordPress",
"product": "Core",
"vulnerability_name": "WordPress Core Interpretation Conflict Vulnerability",
"date_added": "2026-07-21",
"short_description": "WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-24",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.",
"epss_score": 0.08946
}
],
"software_update": [
{
"digest_date": "2026-07-24",
"key": "drupal:10.6",
"product": "drupal",
"category": "cms",
"cycle": "10.6",
"latest": "10.6.14",
"release_date": "2025-12-17",
"latest_release_date": "2026-07-23",
"eol_date": "2026-12-16",
"support_date": "2026-06-16",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-07-24",
"key": "drupal:11.3",
"product": "drupal",
"category": "cms",
"cycle": "11.3",
"latest": "11.3.16",
"release_date": "2025-12-17",
"latest_release_date": "2026-07-23",
"eol_date": "2026-12-16",
"support_date": "2026-06-16",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-07-24",
"key": "nextcloud:32",
"product": "nextcloud",
"category": "cms",
"cycle": "32",
"latest": "32.0.13",
"release_date": "2025-09-27",
"latest_release_date": "2026-07-23",
"eol_date": "2026-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-24",
"key": "nextcloud:33",
"product": "nextcloud",
"category": "cms",
"cycle": "33",
"latest": "33.0.7",
"release_date": "2026-02-18",
"latest_release_date": "2026-07-23",
"eol_date": "2027-02-28",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-24",
"key": "nextcloud:34",
"product": "nextcloud",
"category": "cms",
"cycle": "34",
"latest": "34.0.2",
"release_date": "2026-06-09",
"latest_release_date": "2026-07-23",
"eol_date": "2027-06-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-07-24",
"key": "rabbitmq:4.3",
"product": "rabbitmq",
"category": "middleware",
"cycle": "4.3",
"latest": "4.3.4",
"release_date": "2026-04-23",
"latest_release_date": "2026-07-23",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
}
]
}