📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 4
|
更新ソフト 10
|
対象期間 7日
|
生成 2026-08-06 11:01:16
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| amazon-linux (2) | 2.0.20260727.0 | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-linux (2023) | 2023.12.20260727.0 | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| django (5.2) | 5.2.17 | 2026-08-04 | 25 | 2 | 7 | 0 | ⚠️要確認 |
| django (6.0) | 6.0.8 | 2026-08-04 | 25 | 2 | 7 | 0 | ⚠️要確認 |
| laravel (13) | 13.24.0 | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| gitlab (18.11) | 18.11.8 | 2026-08-03 | 171 | 0 | 51 | 0 | 🟠重要 |
| nodejs (24) | 24.19.0 | 2026-08-03 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nodejs (26) | 26.6.0 | 2026-08-03 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| apache-struts (6) | 6.11.0 | 2026-08-01 | 3 | 0 | 3 | 0 | 🟠重要 |
| apache-struts (7) | 7.3.0 | 2026-08-01 | 3 | 0 | 3 | 0 | 🟠重要 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| CVE-2026-34486 | Apache Tomcat | 7.5 | ✓ | N | パッチ即時 |
EncryptInterceptor のバイパス（クラスタ通信の暗号化欠落）とされているため、影響はクラスタ構成（<Cluster> / DeltaManager 等）を有効化した環境に限定される可能性がある。まず自社 Tomcat のクラスタ設定有無を確認し、該当する場合は優先的にパッチ適用することを推奨する。詳細は Apache 公式アドバイザリで確認のこと。🟠 ★★ 参考 CVE
展開して表示 (8件)
📝 AI 全体サマリ
展開して読む
- EOL 超過が 2 件。amazon-linux 2（EOL: 2026-06-30）と gitlab 18.11（EOL: 2026-07-16）はいずれもサポート期限を過ぎている。更新自体は配信されているが、今後のセキュリティ修正が保証されない可能性があるため、Amazon Linux 2023 系および GitLab の後続マイナーへの移行計画を優先度高めで検討したい。
- GitLab 18.11.8 は High 51 件という累積 CVE 件数が目立つが、これは製品全体の履歴集計値であり本リリースの新規修正件数とは一致しない可能性がある。実際の修正内容は GitLab 公式のパッチリリースノートで確認すること。
- apache-struts の eol_date が文字列 "false" で入っており、データ品質上の注意点として記録しておく（SecuPortal 側の正規化漏れの可能性がある）。
- 本ダイジェストの top_cves には attack_vector / is_remote / KEV フラグが含まれないため、CVSS 9.0 以上でも ★★★ 判定はできず ★★ に留めている。★★★ 判定精度を上げるなら、top_cves にも AV とランサムウェア関連フラグを付与する改善が有効と考えられる。
```yaml
# docker-compose.yml（骨子 / 検証環境専用・外部公開しないこと）
services:
tomcat-a:
image: tomcat:<脆弱版タグ> # 公式アドバイザリで影響バージョンを確認して指定
volumes:
- ./conf/server-cluster.xml:/usr/local/tomcat/conf/server.xml:ro
- ./webapps/session-demo:/usr/local/tomcat/webapps/session-demo:ro
networks: [cluster-net]
tomcat-b:
image: tomcat:<脆弱版タグ>
volumes:
- ./conf/server-cluster.xml:/usr/local/tomcat/conf/server.xml:ro
- ./webapps/session-demo:/usr/local/tomcat/webapps/session-demo:ro
networks: [cluster-net]
capture:
image: nicolaka/netshoot # クラスタ間通信の暗号化有無を観測するのみ
command: sleep infinity
cap_add: [NET_ADMIN, NET_RAW]
network_mode: "service:tomcat-a"
networks:
cluster-net:
driver: bridge
```
検証手順の骨子:
1. server-cluster.xml に <Cluster> + <Interceptor className="...EncryptInterceptor">（encryptionKey 設定込み）を定義し、2 ノードでセッションレプリケーションが成立することを確認する。
2. capture コンテナから cluster-net 上のノード間通信をキャプチャし、セッションデータが平文で観測されるか（＝暗号化が適用されていないか）を確認する。ここが影響有無の判定ポイントになる。
3. Tomcat を修正版に差し替え、同じ観測手順で平文が消えることを確認する。
4. 併せて自社の実 Tomcat で <Cluster> / EncryptInterceptor の使用有無を棚卸しし、未使用であれば優先度を下げる判断材料とする。
※ 影響バージョン・修正バージョン・設定条件はいずれも Apache Tomcat 公式アドバイザリおよび CISA KEV エントリで確認したうえで実施すること。検証環境は隔離ネットワークに閉じること。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-07-31",
"to": "2026-08-06",
"days": 7
},
"summary": {
"total_kev_new": 4,
"total_software_update": 10,
"by_date": {
"2026-08-05": {
"kev_new": 3,
"software_update": 5
},
"2026-08-04": {
"kev_new": 1,
"software_update": 3
},
"2026-08-02": {
"kev_new": 0,
"software_update": 2
}
}
},
"kev_new": [
{
"digest_date": "2026-08-05",
"key": "CVE-2026-18556",
"cve_id": "CVE-2026-18556",
"vendor_project": "N-able",
"product": "N-central",
"vulnerability_name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"date_added": "2026-08-04",
"short_description": "N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.",
"epss_score": 0.0027
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-34486",
"cve_id": "CVE-2026-34486",
"vendor_project": "Apache",
"product": "Tomcat",
"vulnerability_name": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
"date_added": "2026-08-04",
"short_description": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": 7.5,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "tomcat",
"title_en": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
"epss_score": 0.42627
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-9198",
"cve_id": "CVE-2026-9198",
"vendor_project": "IBM",
"product": "Langflow",
"vulnerability_name": "IBM Langflow Code Injection Vulnerability",
"date_added": "2026-08-04",
"short_description": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments",
"epss_score": 0.01886
},
{
"digest_date": "2026-08-04",
"key": "CVE-2026-18577",
"cve_id": "CVE-2026-18577",
"vendor_project": "N-able",
"product": "N-central",
"vulnerability_name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"date_added": "2026-08-03",
"short_description": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-06",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
"epss_score": 0.01477
}
],
"software_update": [
{
"digest_date": "2026-08-05",
"key": "amazon-linux:2",
"product": "amazon-linux",
"category": "os",
"cycle": "2",
"latest": "2.0.20260727.0",
"release_date": "2018-06-26",
"latest_release_date": "2026-08-04",
"eol_date": "2026-06-30",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "amazon-linux:2023",
"product": "amazon-linux",
"category": "os",
"cycle": "2023",
"latest": "2023.12.20260727.0",
"release_date": "2023-03-01",
"latest_release_date": "2026-08-04",
"eol_date": "2029-06-30",
"support_date": "2027-06-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "django:5.2",
"product": "django",
"category": "framework",
"cycle": "5.2",
"latest": "5.2.17",
"release_date": "2025-04-02",
"latest_release_date": "2026-08-04",
"eol_date": "2028-04-30",
"support_date": "2025-12-03",
"is_major_product": true,
"cve_stats": {
"total": 25,
"critical": 2,
"high": 7,
"medium": 8,
"low": 8,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-4277",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-64459",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-3902",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-05",
"key": "django:6.0",
"product": "django",
"category": "framework",
"cycle": "6.0",
"latest": "6.0.8",
"release_date": "2025-12-03",
"latest_release_date": "2026-08-04",
"eol_date": "2027-04-30",
"support_date": "2026-08-31",
"is_major_product": true,
"cve_stats": {
"total": 25,
"critical": 2,
"high": 7,
"medium": 8,
"low": 8,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-4277",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-64459",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-3902",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-05",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.24.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-04",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-04",
"key": "gitlab:18.11",
"product": "gitlab",
"category": "devops",
"cycle": "18.11",
"latest": "18.11.8",
"release_date": "2026-04-16",
"latest_release_date": "2026-08-03",
"eol_date": "2026-07-16",
"support_date": "2026-05-21",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-9222",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-1090",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6073",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-04",
"key": "nodejs:24",
"product": "nodejs",
"category": "programming",
"cycle": "24",
"latest": "24.19.0",
"release_date": "2025-05-06",
"latest_release_date": "2026-08-03",
"eol_date": "2028-04-30",
"support_date": "2026-10-20",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-04",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.6.0",
"release_date": "2026-05-05",
"latest_release_date": "2026-08-03",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-02",
"key": "apache-struts:6",
"product": "apache-struts",
"category": "framework",
"cycle": "6",
"latest": "6.11.0",
"release_date": "2022-06-02",
"latest_release_date": "2026-08-01",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 3,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-66675",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2025-68493",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2025-64775",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-02",
"key": "apache-struts:7",
"product": "apache-struts",
"category": "framework",
"cycle": "7",
"latest": "7.3.0",
"release_date": "2024-12-11",
"latest_release_date": "2026-08-01",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 3,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-66675",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2025-68493",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2025-64775",
"severity": "HIGH",
"score": 7.5
}
]
}
}
]
}