📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 24
|
対象期間 7日
|
生成 2026-08-03 15:12:00
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| apache-struts (6) | 6.11.0 | 2026-08-01 | 3 | 0 | 3 | 0 | 🟠重要 |
| apache-struts (7) | 7.3.0 | 2026-08-01 | 3 | 0 | 3 | 0 | 🟠重要 |
| nodejs (22) | 22.23.2 | 2026-07-29 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nodejs (24) | 24.18.1 | 2026-07-29 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nodejs (26) | 26.5.1 | 2026-07-29 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| rails (7.2) | 7.2.3.2 | 2026-07-29 | 8 | 2 | 2 | 0 | ⚠️要確認 |
| rails (8.0) | 8.0.5.1 | 2026-07-29 | 8 | 2 | 2 | 0 | ⚠️要確認 |
| rails (8.1) | 8.1.3.1 | 2026-07-29 | 8 | 2 | 2 | 0 | ⚠️要確認 |
| symfony (6.4) | 6.4.43 | 2026-07-29 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| symfony (7.4) | 7.4.15 | 2026-07-29 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| symfony (8.0) | 8.0.16 | 2026-07-29 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| symfony (8.1) | 8.1.3 | 2026-07-29 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| gitlab (19.0) | 19.0.5 | 2026-07-29 | 171 | 0 | 51 | 0 | 🟠重要 |
| gitlab (19.1) | 19.1.3 | 2026-07-29 | 171 | 0 | 51 | 0 | 🟠重要 |
| gitlab (19.2) | 19.2.1 | 2026-07-29 | 171 | 0 | 51 | 0 | 🟠重要 |
| haproxy (2.6) | 2.6.32 | 2026-07-29 | 1 | 0 | 1 | 0 | 🟠重要 |
| haproxy (2.8) | 2.8.27 | 2026-07-29 | 1 | 0 | 1 | 0 | 🟠重要 |
| haproxy (3.0) | 3.0.26 | 2026-07-29 | 1 | 0 | 1 | 0 | 🟠重要 |
| haproxy (3.2) | 3.2.22 | 2026-07-29 | 1 | 0 | 1 | 0 | 🟠重要 |
| haproxy (3.3) | 3.3.13 | 2026-07-29 | 1 | 0 | 1 | 0 | 🟠重要 |
| haproxy (3.4) | 3.4.3 | 2026-07-29 | 1 | 0 | 1 | 0 | 🟠重要 |
| angular (20) | 20.3.27 | 2026-07-29 | 4 | 0 | 0 | 0 | ✅計画 |
| angular (21) | 21.2.19 | 2026-07-29 | 4 | 0 | 0 | 0 | ✅計画 |
| angular (22) | 22.1.0 | 2026-07-29 | 4 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
is_major_product=false（Cisco / Fortinet / Arista）で、自社の運用対象外である可能性が高いと考えられます。is_remote / KEV 該当情報が付与されていないため、★★★ の判定条件を満たすと断定できません。リモート攻撃可能性については公式アドバイザリで確認のうえ、必要なら★★★へ昇格させる運用を推奨します。🟠 ★★ 参考 CVE
展開して表示 (11件)
📝 AI 全体サマリ
展開して読む
全体トレンド (2〜3文)
今週は 7/29 に Node.js / Rails / Symfony / GitLab / HAProxy / Angular が一斉にセキュリティリリースを出し、8/1 に Apache Struts 6/7 系が続く形となりました。KEV 新規追加は 3 件（Cisco FMC / Fortinet FortiOS / Arista VeloCloud）で、いずれもエンタープライズ機器側であり自社運用対象外の見込みのため、実務上の負荷は「アプリ層フレームワークの定期パッチ適用」に集中する週と整理できます。★★★ 該当は 0 件ですが、CVSS 9.0 以上が計 8 件（Node.js 3 / Rails 2 / Symfony 3）ある点は軽視できず、実際の利用有無の棚卸しが次の一手になると考えられます。
特記事項
is_remote / KEV フラグが software_update 側の CVE に付与されていないため、ランク付けの精度が KEV リスト側に比べて落ちています。SecuPortal 側で top_cves にも攻撃ベクトル情報を付加できると、★★★ の取りこぼしリスクを下げられる可能性があります。PoC 検証を推奨する CVE と環境構築の骨子
優先度としては CVE-2026-21636 / CVE-2026-48930 / CVE-2025-55130（Node.js 系） を、Next.js 実行基盤への影響確認という文脈で検証環境に載せる価値があると考えられます。以下は隔離環境の骨子のみで、exploit コードは含みません。実際の再現手順は公式アドバイザリおよびベンダー提供の再現条件に従ってください。
# docker-compose.yml（検証用・外部公開しないこと）
services:
node-vuln:
image: node:22.23.1-bookworm # 修正前バージョンを固定
working_dir: /app
volumes: ["./app:/app"]
command: ["node", "server.js"]
networks: [lab]
node-fixed:
image: node:22.23.2-bookworm # 修正後バージョン
working_dir: /app
volumes: ["./app:/app"]
command: ["node", "server.js"]
networks: [lab]
networks:
lab:
internal: true # 外部到達を遮断
検証の進め方（骨子）:
1. 修正前／修正後の 2 コンテナで同一アプリを起動し、挙動差分を取る構成にする
2. internal: true とホストポート非公開により、検証トラフィックをラボ内に封じ込める
3. Node.js 公式セキュリティリリースノートで影響モジュール・前提条件（該当 API の使用有無等）を確認し、自社アプリが該当コードパスを通るかを静的に先に切り分ける
4. 静的確認で該当しなければ動的検証は不要と判断してよい可能性がある（工数節約の観点）
5. Rails / Symfony については自社利用が確認できた場合に限り、同様の 2 バージョン並置パターンで検証環境を用意する
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-07-28",
"to": "2026-08-03",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 24,
"by_date": {
"2026-08-02": {
"kev_new": 0,
"software_update": 2
},
"2026-07-30": {
"kev_new": 1,
"software_update": 22
},
"2026-07-28": {
"kev_new": 2,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-07-30",
"key": "CVE-2026-20316",
"cve_id": "CVE-2026-20316",
"vendor_project": "Cisco",
"product": "Secure Firewall Management Center (FMC)",
"vulnerability_name": "Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability",
"date_added": "2026-07-29",
"short_description": "Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-01",
"known_ransomware": "Unknown",
"cvss_score": 5.3,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow t",
"epss_score": null
},
{
"digest_date": "2026-07-28",
"key": "CVE-2025-68686",
"cve_id": "CVE-2025-68686",
"vendor_project": "Fortinet",
"product": "FortiOS",
"vulnerability_name": "Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability",
"date_added": "2026-07-27",
"short_description": "Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-10",
"known_ransomware": "Unknown",
"cvss_score": 5.9,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via anothe",
"epss_score": 0.00477
},
{
"digest_date": "2026-07-28",
"key": "CVE-2026-16812",
"cve_id": "CVE-2026-16812",
"vendor_project": "Arista",
"product": "VeloCloud Orchestrator",
"vulnerability_name": "Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability",
"date_added": "2026-07-27",
"short_description": "Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-07-30",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in a",
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-08-02",
"key": "apache-struts:6",
"product": "apache-struts",
"category": "framework",
"cycle": "6",
"latest": "6.11.0",
"release_date": "2022-06-02",
"latest_release_date": "2026-08-01",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 3,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-66675",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2025-68493",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2025-64775",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-02",
"key": "apache-struts:7",
"product": "apache-struts",
"category": "framework",
"cycle": "7",
"latest": "7.3.0",
"release_date": "2024-12-11",
"latest_release_date": "2026-08-01",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 3,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-66675",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2025-68493",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2025-64775",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "angular:20",
"product": "angular",
"category": "framework",
"cycle": "20",
"latest": "20.3.27",
"release_date": "2025-05-28",
"latest_release_date": "2026-07-29",
"eol_date": "2026-11-28",
"support_date": "2025-11-19",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 0,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-22610",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-27970",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2025-66412",
"severity": "MEDIUM",
"score": 5.4
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "angular:21",
"product": "angular",
"category": "framework",
"cycle": "21",
"latest": "21.2.19",
"release_date": "2025-11-19",
"latest_release_date": "2026-07-29",
"eol_date": "2027-06-30",
"support_date": "2026-06-03",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 0,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-22610",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-27970",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2025-66412",
"severity": "MEDIUM",
"score": 5.4
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "angular:22",
"product": "angular",
"category": "framework",
"cycle": "22",
"latest": "22.1.0",
"release_date": "2026-06-03",
"latest_release_date": "2026-07-29",
"eol_date": "2028-06-30",
"support_date": "2027-06-30",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 0,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-22610",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-27970",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2025-66412",
"severity": "MEDIUM",
"score": 5.4
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "gitlab:19.0",
"product": "gitlab",
"category": "devops",
"cycle": "19.0",
"latest": "19.0.5",
"release_date": "2026-05-21",
"latest_release_date": "2026-07-29",
"eol_date": "2026-08-20",
"support_date": "2026-06-18",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-1090",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6896",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "gitlab:19.1",
"product": "gitlab",
"category": "devops",
"cycle": "19.1",
"latest": "19.1.3",
"release_date": "2026-06-18",
"latest_release_date": "2026-07-29",
"eol_date": "2026-09-17",
"support_date": "2026-07-16",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-1090",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6896",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "gitlab:19.2",
"product": "gitlab",
"category": "devops",
"cycle": "19.2",
"latest": "19.2.1",
"release_date": "2026-07-16",
"latest_release_date": "2026-07-29",
"eol_date": "2026-10-20",
"support_date": "2026-08-20",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-1090",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6896",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "haproxy:2.6",
"product": "haproxy",
"category": "webserver",
"cycle": "2.6",
"latest": "2.6.32",
"release_date": "2022-05-31",
"latest_release_date": "2026-07-29",
"eol_date": "2027-04-01",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-11230",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "haproxy:2.8",
"product": "haproxy",
"category": "webserver",
"cycle": "2.8",
"latest": "2.8.27",
"release_date": "2023-05-31",
"latest_release_date": "2026-07-29",
"eol_date": "2028-04-01",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-11230",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "haproxy:3.0",
"product": "haproxy",
"category": "webserver",
"cycle": "3.0",
"latest": "3.0.26",
"release_date": "2024-05-29",
"latest_release_date": "2026-07-29",
"eol_date": "2029-04-01",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-11230",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "haproxy:3.2",
"product": "haproxy",
"category": "webserver",
"cycle": "3.2",
"latest": "3.2.22",
"release_date": "2025-05-28",
"latest_release_date": "2026-07-29",
"eol_date": "2030-04-01",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-11230",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "haproxy:3.3",
"product": "haproxy",
"category": "webserver",
"cycle": "3.3",
"latest": "3.3.13",
"release_date": "2025-11-26",
"latest_release_date": "2026-07-29",
"eol_date": "2027-01-01",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-11230",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "haproxy:3.4",
"product": "haproxy",
"category": "webserver",
"cycle": "3.4",
"latest": "3.4.3",
"release_date": "2026-06-03",
"latest_release_date": "2026-07-29",
"eol_date": "2031-04-01",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-11230",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "nodejs:22",
"product": "nodejs",
"category": "programming",
"cycle": "22",
"latest": "22.23.2",
"release_date": "2024-04-24",
"latest_release_date": "2026-07-29",
"eol_date": "2027-04-30",
"support_date": "2025-10-21",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "nodejs:24",
"product": "nodejs",
"category": "programming",
"cycle": "24",
"latest": "24.18.1",
"release_date": "2025-05-06",
"latest_release_date": "2026-07-29",
"eol_date": "2028-04-30",
"support_date": "2026-10-20",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.5.1",
"release_date": "2026-05-05",
"latest_release_date": "2026-07-29",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "rails:7.2",
"product": "rails",
"category": "framework",
"cycle": "7.2",
"latest": "7.2.3.2",
"release_date": "2024-08-09",
"latest_release_date": "2026-07-29",
"eol_date": "2026-08-09",
"support_date": "2025-08-09",
"is_major_product": true,
"cve_stats": {
"total": 8,
"critical": 2,
"high": 2,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33195",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-33202",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-33176",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "rails:8.0",
"product": "rails",
"category": "framework",
"cycle": "8.0",
"latest": "8.0.5.1",
"release_date": "2024-11-07",
"latest_release_date": "2026-07-29",
"eol_date": "2026-11-07",
"support_date": "2026-05-07",
"is_major_product": true,
"cve_stats": {
"total": 8,
"critical": 2,
"high": 2,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33195",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-33202",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-33176",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "rails:8.1",
"product": "rails",
"category": "framework",
"cycle": "8.1",
"latest": "8.1.3.1",
"release_date": "2025-10-22",
"latest_release_date": "2026-07-29",
"eol_date": "2027-10-10",
"support_date": "2026-10-10",
"is_major_product": true,
"cve_stats": {
"total": 8,
"critical": 2,
"high": 2,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33195",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-33202",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-33176",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "symfony:6.4",
"product": "symfony",
"category": "framework",
"cycle": "6.4",
"latest": "6.4.43",
"release_date": "2023-11-29",
"latest_release_date": "2026-07-29",
"eol_date": "2027-11-30",
"support_date": "2026-11-30",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "symfony:7.4",
"product": "symfony",
"category": "framework",
"cycle": "7.4",
"latest": "7.4.15",
"release_date": "2025-11-27",
"latest_release_date": "2026-07-29",
"eol_date": "2029-11-30",
"support_date": "2028-11-30",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "symfony:8.0",
"product": "symfony",
"category": "framework",
"cycle": "8.0",
"latest": "8.0.16",
"release_date": "2025-11-27",
"latest_release_date": "2026-07-29",
"eol_date": "2026-07-31",
"support_date": "2026-07-31",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-07-30",
"key": "symfony:8.1",
"product": "symfony",
"category": "framework",
"cycle": "8.1",
"latest": "8.1.3",
"release_date": "2026-05-29",
"latest_release_date": "2026-07-29",
"eol_date": "2027-01-31",
"support_date": "2027-01-31",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
}
]
}