📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 22
|
対象期間 7日
|
生成 2026-08-08 14:24:09
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| apache-activemq (6.3) | 6.3.1 | 2026-08-06 | 13 | 0 | 7 | 1 | ⚠️要確認 |
| drupal (10.6) | 10.6.15 | 2026-08-06 | 7 | 0 | 0 | 0 | ✅計画 |
| drupal (11.4) | 11.4.5 | 2026-08-06 | 7 | 0 | 0 | 0 | ✅計画 |
| gitlab (18.11) | 18.11.9 | 2026-08-06 | 171 | 0 | 51 | 0 | 🟠重要 |
| laravel (12) | 12.65.0 | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| nodejs (26) | 26.7.0 | 2026-08-05 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nuxt (3) | 3.21.11 | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| nuxt (4) | 4.5.2 | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| opensearch (3) | 3.8.0 | 2026-08-05 | 1 | 0 | 1 | 0 | 🟠重要 |
| python (3.13) | 3.13.15 | 2026-08-05 | 6 | 0 | 2 | 0 | 🟠重要 |
| python (3.14) | 3.14.7 | 2026-08-05 | 6 | 0 | 2 | 0 | 🟠重要 |
| vue (3.5) | 3.5.41 | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-linux (2) | 2.0.20260727.0 | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-linux (2023) | 2023.12.20260727.0 | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| django (5.2) | 5.2.17 | 2026-08-04 | 25 | 2 | 7 | 0 | ⚠️要確認 |
| django (6.0) | 6.0.8 | 2026-08-04 | 25 | 2 | 7 | 0 | ⚠️要確認 |
| laravel (13) | 13.24.0 | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| gitlab (18.11) | 18.11.8 | 2026-08-03 | 171 | 0 | 51 | 0 | 🟠重要 |
| nodejs (24) | 24.19.0 | 2026-08-03 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nodejs (26) | 26.6.0 | 2026-08-03 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| apache-struts (6) | 6.11.0 | 2026-08-01 | 3 | 0 | 3 | 0 | 🟠重要 |
| apache-struts (7) | 7.3.0 | 2026-08-01 | 3 | 0 | 3 | 0 | 🟠重要 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（補足: KEV 新規収載のうち自社主要製品に該当するのは CVE-2026-34486 (Apache Tomcat) のみですが、CVSS 7.5 かつ ransomware=Unknown のため方針上 ★★★ の条件は満たしません。ただし EPSS 0.426 と高めであり、実質的な優先度は高い可能性があるため下記 ★★ 側で扱います。）
🟠 ★★ 参考 CVE
展開して表示 (4件)
📝 AI 全体サマリ
展開して読む
- GitLab 18.11 は eol_date=2026-07-16、Nuxt 3 は 2026-07-31、amazon-linux 2 は 2026-06-30 と、いずれも すでに EOL を過ぎたサイクルにパッチが出ている状態に見える。Drupal 10.6 も 2026-12-16 で EOL が近い。バージョンアップ計画の見直しが必要な可能性があるため、公式のサポートポリシーで最新の EOL を確認することを推奨。
- GitLab は 3 日間で 18.11.8 → 18.11.9 と連続リリースされている。18.11.8 に何らかの問題があった可能性も含め、リリースノートを確認したうえで 18.11.9 へ寄せるのが無難と考えられる。
- cve_stats は「そのサイクルに紐づく既知 CVE の累積」を示していると見られ、Node.js の Critical 3 件 (CVE-2026-21636 CVSS 10.0 等) や Django の Critical 2 件 (CVE-2026-4277 CVSS 9.8 等) が今回のリリースで修正されたものとは限らない。各リリースノートで修正対象 CVE を突き合わせて判断することを推奨。
```yaml
# docker-compose.yml (骨子) — Tomcat 2ノードのクラスタでノード間通信を観測する
services:
tomcat-a:
image: tomcat:<検証対象バージョン> # 公式アドバイザリの影響バージョンを指定
volumes:
- ./server.xml:/usr/local/tomcat/conf/server.xml:ro # Cluster + EncryptInterceptor を設定
- ./app:/usr/local/tomcat/webapps/app # セッションに値を入れるだけの最小アプリ
networks: [cluster]
tomcat-b:
image: tomcat:<検証対象バージョン>
volumes:
- ./server.xml:/usr/local/tomcat/conf/server.xml:ro
- ./app:/usr/local/tomcat/webapps/app
networks: [cluster]
observer:
image: nicolaka/netshoot # tcpdump でクラスタ通信を取得・暗号化状態の確認のみに使用
network_mode: "service:tomcat-a"
cap_add: [NET_ADMIN]
command: ["sleep", "infinity"]
networks:
cluster:
```
検証手順の骨子: (1) server.xml に <Cluster> + <Interceptor className="...EncryptInterceptor">（encryptionKey 設定込み）を入れて 2 ノードを起動 → (2) 片方のノードでセッションに判別可能な文字列を格納 → (3) observer から tcpdump でノード間トラフィックを取得し、当該文字列が平文で出現するかを確認 → (4) 修正済みバージョンで同手順を実施して差分を比較。※検証は自社の隔離環境（脆弱性検証環境の構築 プロジェクト配下）で行い、外部到達性を持たせないこと。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-02",
"to": "2026-08-08",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 22,
"by_date": {
"2026-08-07": {
"kev_new": 0,
"software_update": 4
},
"2026-08-06": {
"kev_new": 1,
"software_update": 8
},
"2026-08-05": {
"kev_new": 3,
"software_update": 5
},
"2026-08-04": {
"kev_new": 1,
"software_update": 3
},
"2026-08-02": {
"kev_new": 0,
"software_update": 2
}
}
},
"kev_new": [
{
"digest_date": "2026-08-06",
"key": "CVE-2026-63077",
"cve_id": "CVE-2026-63077",
"vendor_project": "JetBrains",
"product": "TeamCity",
"vulnerability_name": "JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
"date_added": "2026-08-05",
"short_description": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-08",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol",
"epss_score": 0.00649
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-18556",
"cve_id": "CVE-2026-18556",
"vendor_project": "N-able",
"product": "N-central",
"vulnerability_name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"date_added": "2026-08-04",
"short_description": "N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.",
"epss_score": 0.0027
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-34486",
"cve_id": "CVE-2026-34486",
"vendor_project": "Apache",
"product": "Tomcat",
"vulnerability_name": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
"date_added": "2026-08-04",
"short_description": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": 7.5,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "tomcat",
"title_en": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
"epss_score": 0.42627
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-9198",
"cve_id": "CVE-2026-9198",
"vendor_project": "IBM",
"product": "Langflow",
"vulnerability_name": "IBM Langflow Code Injection Vulnerability",
"date_added": "2026-08-04",
"short_description": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments",
"epss_score": 0.01886
},
{
"digest_date": "2026-08-04",
"key": "CVE-2026-18577",
"cve_id": "CVE-2026-18577",
"vendor_project": "N-able",
"product": "N-central",
"vulnerability_name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"date_added": "2026-08-03",
"short_description": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-06",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
"epss_score": 0.01477
}
],
"software_update": [
{
"digest_date": "2026-08-07",
"key": "apache-activemq:6.3",
"product": "apache-activemq",
"category": "middleware",
"cycle": "6.3",
"latest": "6.3.1",
"release_date": "2026-07-24",
"latest_release_date": "2026-08-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 13,
"critical": 0,
"high": 7,
"medium": 6,
"low": 0,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-49157",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-40466",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-45505",
"severity": "HIGH",
"score": 8.8
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "drupal:10.6",
"product": "drupal",
"category": "cms",
"cycle": "10.6",
"latest": "10.6.15",
"release_date": "2025-12-17",
"latest_release_date": "2026-08-06",
"eol_date": "2026-12-16",
"support_date": "2026-06-16",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "drupal:11.4",
"product": "drupal",
"category": "cms",
"cycle": "11.4",
"latest": "11.4.5",
"release_date": "2026-07-01",
"latest_release_date": "2026-08-06",
"eol_date": "2027-07-07",
"support_date": "2027-01-01",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "gitlab:18.11",
"product": "gitlab",
"category": "devops",
"cycle": "18.11",
"latest": "18.11.9",
"release_date": "2026-04-16",
"latest_release_date": "2026-08-06",
"eol_date": "2026-07-16",
"support_date": "2026-05-21",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-9222",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.65.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-05",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-06",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.7.0",
"release_date": "2026-05-05",
"latest_release_date": "2026-08-05",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "nuxt:3",
"product": "nuxt",
"category": "framework",
"cycle": "3",
"latest": "3.21.11",
"release_date": "2022-11-16",
"latest_release_date": "2026-08-05",
"eol_date": "2026-07-31",
"support_date": "2025-07-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-06",
"key": "nuxt:4",
"product": "nuxt",
"category": "framework",
"cycle": "4",
"latest": "4.5.2",
"release_date": "2025-07-16",
"latest_release_date": "2026-08-05",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-06",
"key": "opensearch:3",
"product": "opensearch",
"category": "database",
"cycle": "3",
"latest": "3.8.0",
"release_date": "2025-05-06",
"latest_release_date": "2026-08-05",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-9624",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "python:3.13",
"product": "python",
"category": "programming",
"cycle": "3.13",
"latest": "3.13.15",
"release_date": "2024-10-07",
"latest_release_date": "2026-08-05",
"eol_date": "2029-10-31",
"support_date": "2026-10-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "python:3.14",
"product": "python",
"category": "programming",
"cycle": "3.14",
"latest": "3.14.7",
"release_date": "2025-10-07",
"latest_release_date": "2026-08-05",
"eol_date": "2030-10-31",
"support_date": "2027-10-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "vue:3.5",
"product": "vue",
"category": "framework",
"cycle": "3.5",
"latest": "3.5.41",
"release_date": "2024-09-03",
"latest_release_date": "2026-08-05",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "amazon-linux:2",
"product": "amazon-linux",
"category": "os",
"cycle": "2",
"latest": "2.0.20260727.0",
"release_date": "2018-06-26",
"latest_release_date": "2026-08-04",
"eol_date": "2026-06-30",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "amazon-linux:2023",
"product": "amazon-linux",
"category": "os",
"cycle": "2023",
"latest": "2023.12.20260727.0",
"release_date": "2023-03-01",
"latest_release_date": "2026-08-04",
"eol_date": "2029-06-30",
"support_date": "2027-06-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "django:5.2",
"product": "django",
"category": "framework",
"cycle": "5.2",
"latest": "5.2.17",
"release_date": "2025-04-02",
"latest_release_date": "2026-08-04",
"eol_date": "2028-04-30",
"support_date": "2025-12-03",
"is_major_product": true,
"cve_stats": {
"total": 25,
"critical": 2,
"high": 7,
"medium": 8,
"low": 8,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-4277",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-64459",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-3902",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-05",
"key": "django:6.0",
"product": "django",
"category": "framework",
"cycle": "6.0",
"latest": "6.0.8",
"release_date": "2025-12-03",
"latest_release_date": "2026-08-04",
"eol_date": "2027-04-30",
"support_date": "2026-08-31",
"is_major_product": true,
"cve_stats": {
"total": 25,
"critical": 2,
"high": 7,
"medium": 8,
"low": 8,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-4277",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-64459",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-3902",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-05",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.24.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-04",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-04",
"key": "gitlab:18.11",
"product": "gitlab",
"category": "devops",
"cycle": "18.11",
"latest": "18.11.8",
"release_date": "2026-04-16",
"latest_release_date": "2026-08-03",
"eol_date": "2026-07-16",
"support_date": "2026-05-21",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-9222",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-1090",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6073",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-04",
"key": "nodejs:24",
"product": "nodejs",
"category": "programming",
"cycle": "24",
"latest": "24.19.0",
"release_date": "2025-05-06",
"latest_release_date": "2026-08-03",
"eol_date": "2028-04-30",
"support_date": "2026-10-20",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-04",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.6.0",
"release_date": "2026-05-05",
"latest_release_date": "2026-08-03",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-02",
"key": "apache-struts:6",
"product": "apache-struts",
"category": "framework",
"cycle": "6",
"latest": "6.11.0",
"release_date": "2022-06-02",
"latest_release_date": "2026-08-01",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 3,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-66675",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2025-68493",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2025-64775",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-02",
"key": "apache-struts:7",
"product": "apache-struts",
"category": "framework",
"cycle": "7",
"latest": "7.3.0",
"release_date": "2024-12-11",
"latest_release_date": "2026-08-01",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 3,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-66675",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2025-68493",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2025-64775",
"severity": "HIGH",
"score": 7.5
}
]
}
}
]
}