📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 6
|
更新ソフト 26
|
対象期間 7日
|
生成 2026-08-09 21:13:33
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| angular | 22.1.1 (cycle 22) | 2026-08-07 | 4 | 0 | 0 | 0 | ✅計画 |
| apache-cassandra | 4.0.21 (cycle 4.0) | 2026-08-07 | 3 | 0 | 1 | 0 | 🟠重要 |
| apache-cassandra | 4.1.12 (cycle 4.1) | 2026-08-07 | 3 | 0 | 1 | 0 | 🟠重要 |
| apache-cassandra | 5.0.9 (cycle 5.0) | 2026-08-07 | 3 | 0 | 1 | 0 | 🟠重要 |
| symfony | 7.4.16 (cycle 7.4) | 2026-08-07 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| symfony | 8.1.4 (cycle 8.1) | 2026-08-07 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| apache-activemq | 6.3.1 (cycle 6.3) | 2026-08-06 | 13 | 0 | 7 | 1 | ⚠️要確認 |
| drupal | 10.6.15 (cycle 10.6) | 2026-08-06 | 7 | 0 | 0 | 0 | ✅計画 |
| drupal | 11.4.5 (cycle 11.4) | 2026-08-06 | 7 | 0 | 0 | 0 | ✅計画 |
| gitlab | 18.11.9 (cycle 18.11) | 2026-08-06 | 171 | 0 | 51 | 0 | 🟠重要 |
| laravel | 12.65.0 (cycle 12) | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| nodejs | 26.7.0 (cycle 26) | 2026-08-05 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nuxt | 3.21.11 (cycle 3) | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| nuxt | 4.5.2 (cycle 4) | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| opensearch | 3.8.0 (cycle 3) | 2026-08-05 | 1 | 0 | 1 | 0 | 🟠重要 |
| python | 3.13.15 (cycle 3.13) | 2026-08-05 | 6 | 0 | 2 | 0 | 🟠重要 |
| python | 3.14.7 (cycle 3.14) | 2026-08-05 | 6 | 0 | 2 | 0 | 🟠重要 |
| vue | 3.5.41 (cycle 3.5) | 2026-08-05 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-linux | 2.0.20260727.0 (cycle 2) | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-linux | 2023.12.20260727.0 (cycle 2023) | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| django | 5.2.17 (cycle 5.2) | 2026-08-04 | 25 | 2 | 7 | 0 | ⚠️要確認 |
| django | 6.0.8 (cycle 6.0) | 2026-08-04 | 25 | 2 | 7 | 0 | ⚠️要確認 |
| laravel | 13.24.0 (cycle 13) | 2026-08-04 | 0 | 0 | 0 | 0 | ✅計画 |
| gitlab | 18.11.8 (cycle 18.11) | 2026-08-03 | 171 | 0 | 51 | 0 | 🟠重要 |
| nodejs | 24.19.0 (cycle 24) | 2026-08-03 | 16 | 3 | 7 | 0 | ⚠️要確認 |
| nodejs | 26.6.0 (cycle 26) | 2026-08-03 | 16 | 3 | 7 | 0 | ⚠️要確認 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
KEV 新規追加 6 件のうち、自社の主要製品に該当するのは Apache Tomcat の CVE-2026-34486（CVSS 7.5 / HIGH）のみで、CVSS 9.0 未満かつ ransomware=Unknown のため★★★の条件を満たしません。ただし KEV 該当・EPSS 0.43 と悪用実績のある案件であり、下記★★参考の筆頭として早めの対応を検討する価値がある可能性があります。
🟠 ★★ 参考 CVE
展開して表示 (3件)
（参考: CVE-2026-9198 IBM Langflow CVSS 9.8 / CVE-2026-18556・CVE-2026-18577 N-able N-central は、いずれも KEV 該当だが CVSS 9.5 未満または未採番かつ非主要製品のため★その他に分類。特に N-central の 2 件は CVE-2026-18556 の修正が不完全だったことによる連鎖案件で、MSP 系ツール利用があれば公式アドバイザリで確認を推奨。）
📝 AI 全体サマリ
展開して読む
- N-able N-central の CVE-2026-18577 は CVE-2026-18556 の不完全修正によるもので、「パッチ適用済み」でも回避される可能性があります。同種のパターン（不完全修正の再登録）は他製品でも起こりうるため、パッチ適用後の再アドバイザリ確認を運用に含めることを推奨します。
- EOL 超過が複数: gitlab 18.11 (EOL 2026-07-16)、nuxt 3 (EOL 2026-07-31)、amazon-linux 2 (EOL 2026-06-30)、drupal 10.6 (EOL 2026-12-16 が接近) がサポート期限を過ぎている／間近です。特に GitLab は High 51 件を抱えるため、サポート対象サイクルへの移行計画を優先度高めで検討する価値があります。
- GitLab は 1 週間で 18.11.8 → 18.11.9 と 2 回リリースされており、パッチリリース系の変更が続いている可能性があります。リリースノートでセキュリティ修正の有無を確認してください。
- Node.js の CVE-2026-21636 (CVSS 10.0) は cve_stats 上の累積 top_cves として現れているもので、今回の 24.19.0 / 26.6.0 / 26.7.0 で修正された内容とは一致しない可能性があります。実際の修正範囲は Node.js 公式のセキュリティリリース告知で確認が必要です。
- Cassandra の CVE-2026-27314 (CVSS 8.8) が 4.0 / 4.1 / 5.0 の全サイクルに跨って計上されており、共通コンポーネント起因の可能性があります。
自社影響の観点から、検証優先度が最も高いのは CVE-2026-34486 (Apache Tomcat / EncryptInterceptor バイパス) です。KEV 掲載済みで、かつ自社の主要製品に該当する唯一の案件のため、「自社の Tomcat 構成が影響条件（クラスタリング + EncryptInterceptor 使用）に合致するか」を切り分ける目的での再現環境が有用と考えられます。
検証環境の骨子（クラスタ通信の暗号化が実際に効いているかを観測するための構成のみ。exploit は含めません）:
```yaml
# docker-compose.yml (骨子)
services:
tomcat-a:
image: tomcat:<検証対象バージョン>-jdk17
volumes:
- ./conf/server-a.xml:/usr/local/tomcat/conf/server.xml:ro
- ./webapps/session-demo:/usr/local/tomcat/webapps/session-demo:ro
networks: [cluster]
tomcat-b:
image: tomcat:<検証対象バージョン>-jdk17
volumes:
- ./conf/server-b.xml:/usr/local/tomcat/conf/server.xml:ro
- ./webapps/session-demo:/usr/local/tomcat/webapps/session-demo:ro
networks: [cluster]
# クラスタ間トラフィックを観測し、暗号化されているかを確認する用途
observer:
image: nicolaka/netshoot
network_mode: "service:tomcat-a"
cap_add: [NET_ADMIN, NET_RAW]
command: sleep infinity
networks:
cluster:
```
- server-*.xml 側では <Cluster className="...SimpleTcpCluster"> に DeltaManager と <Interceptor className="...EncryptInterceptor">（encryptionKey 指定）を構成し、2 ノード間でセッションレプリケーションが成立する状態を作ります。
- 検証内容は「observer から tcpdump でクラスタポート（既定 4000-4100 番台）のペイロードを取得し、セッション属性の平文文字列が観測されるかどうか」の確認に留めます。平文が見えなければ当該構成では暗号化が機能していると判断できます。
- 対象バージョンと修正版の 2 パターンで同じ観測を行い、差分を比較する形が切り分けとして有効と考えられます。具体的な影響バージョン範囲は Apache Tomcat 公式のセキュリティアドバイザリで確認してください。
なお Symfony / Django / Node.js の Critical 群は個別 CVE の詳細情報が本ダイジェストに含まれていないため、まず各公式リリースノートで該当バージョンが影響を受けるかを確認するのが先で、PoC 検証の対象選定はその後で判断するのが妥当と考えられます。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-03",
"to": "2026-08-09",
"days": 7
},
"summary": {
"total_kev_new": 6,
"total_software_update": 26,
"by_date": {
"2026-08-08": {
"kev_new": 1,
"software_update": 6
},
"2026-08-07": {
"kev_new": 0,
"software_update": 4
},
"2026-08-06": {
"kev_new": 1,
"software_update": 8
},
"2026-08-05": {
"kev_new": 3,
"software_update": 5
},
"2026-08-04": {
"kev_new": 1,
"software_update": 3
}
}
},
"kev_new": [
{
"digest_date": "2026-08-08",
"key": "CVE-2026-8037",
"cve_id": "CVE-2026-8037",
"vendor_project": "Progress",
"product": "LoadMaster",
"vulnerability_name": "Progress LoadMaster Command Injection Vulnerability",
"date_added": "2026-08-07",
"short_description": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-10",
"known_ransomware": "Unknown",
"cvss_score": 9.6,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "A",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints",
"epss_score": 0.84793
},
{
"digest_date": "2026-08-06",
"key": "CVE-2026-63077",
"cve_id": "CVE-2026-63077",
"vendor_project": "JetBrains",
"product": "TeamCity",
"vulnerability_name": "JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
"date_added": "2026-08-05",
"short_description": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-08",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol",
"epss_score": 0.00649
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-18556",
"cve_id": "CVE-2026-18556",
"vendor_project": "N-able",
"product": "N-central",
"vulnerability_name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"date_added": "2026-08-04",
"short_description": "N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.",
"epss_score": 0.0027
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-34486",
"cve_id": "CVE-2026-34486",
"vendor_project": "Apache",
"product": "Tomcat",
"vulnerability_name": "Apache Tomcat Missing Encryption of Sensitive Data Vulnerability",
"date_added": "2026-08-04",
"short_description": "Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": 7.5,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "tomcat",
"title_en": "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
"epss_score": 0.42627
},
{
"digest_date": "2026-08-05",
"key": "CVE-2026-9198",
"cve_id": "CVE-2026-9198",
"vendor_project": "IBM",
"product": "Langflow",
"vulnerability_name": "IBM Langflow Code Injection Vulnerability",
"date_added": "2026-08-04",
"short_description": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-07",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments",
"epss_score": 0.01886
},
{
"digest_date": "2026-08-04",
"key": "CVE-2026-18577",
"cve_id": "CVE-2026-18577",
"vendor_project": "N-able",
"product": "N-central",
"vulnerability_name": "N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"date_added": "2026-08-03",
"short_description": "N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-06",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1",
"epss_score": 0.01477
}
],
"software_update": [
{
"digest_date": "2026-08-08",
"key": "angular:22",
"product": "angular",
"category": "framework",
"cycle": "22",
"latest": "22.1.1",
"release_date": "2026-06-03",
"latest_release_date": "2026-08-07",
"eol_date": "2028-06-30",
"support_date": "2027-06-30",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 0,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27970",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-22610",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2025-61261",
"severity": "MEDIUM",
"score": 5.4
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "apache-cassandra:4.0",
"product": "apache-cassandra",
"category": "database",
"cycle": "4.0",
"latest": "4.0.21",
"release_date": "2021-07-26",
"latest_release_date": "2026-08-07",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27314",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-32588",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2026-27315",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "apache-cassandra:4.1",
"product": "apache-cassandra",
"category": "database",
"cycle": "4.1",
"latest": "4.1.12",
"release_date": "2022-12-13",
"latest_release_date": "2026-08-07",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27314",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-32588",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2026-27315",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "apache-cassandra:5.0",
"product": "apache-cassandra",
"category": "database",
"cycle": "5.0",
"latest": "5.0.9",
"release_date": "2024-09-05",
"latest_release_date": "2026-08-07",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27314",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-32588",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2026-27315",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "symfony:7.4",
"product": "symfony",
"category": "framework",
"cycle": "7.4",
"latest": "7.4.16",
"release_date": "2025-11-27",
"latest_release_date": "2026-08-07",
"eol_date": "2029-11-30",
"support_date": "2028-11-30",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "symfony:8.1",
"product": "symfony",
"category": "framework",
"cycle": "8.1",
"latest": "8.1.4",
"release_date": "2026-05-29",
"latest_release_date": "2026-08-07",
"eol_date": "2027-01-31",
"support_date": "2027-01-31",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "apache-activemq:6.3",
"product": "apache-activemq",
"category": "middleware",
"cycle": "6.3",
"latest": "6.3.1",
"release_date": "2026-07-24",
"latest_release_date": "2026-08-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 13,
"critical": 0,
"high": 7,
"medium": 6,
"low": 0,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-49157",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-40466",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-45505",
"severity": "HIGH",
"score": 8.8
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "drupal:10.6",
"product": "drupal",
"category": "cms",
"cycle": "10.6",
"latest": "10.6.15",
"release_date": "2025-12-17",
"latest_release_date": "2026-08-06",
"eol_date": "2026-12-16",
"support_date": "2026-06-16",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "drupal:11.4",
"product": "drupal",
"category": "cms",
"cycle": "11.4",
"latest": "11.4.5",
"release_date": "2026-07-01",
"latest_release_date": "2026-08-06",
"eol_date": "2027-07-07",
"support_date": "2027-01-01",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "gitlab:18.11",
"product": "gitlab",
"category": "devops",
"cycle": "18.11",
"latest": "18.11.9",
"release_date": "2026-04-16",
"latest_release_date": "2026-08-06",
"eol_date": "2026-07-16",
"support_date": "2026-05-21",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-9222",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.65.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-05",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-06",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.7.0",
"release_date": "2026-05-05",
"latest_release_date": "2026-08-05",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "nuxt:3",
"product": "nuxt",
"category": "framework",
"cycle": "3",
"latest": "3.21.11",
"release_date": "2022-11-16",
"latest_release_date": "2026-08-05",
"eol_date": "2026-07-31",
"support_date": "2025-07-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-06",
"key": "nuxt:4",
"product": "nuxt",
"category": "framework",
"cycle": "4",
"latest": "4.5.2",
"release_date": "2025-07-16",
"latest_release_date": "2026-08-05",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-06",
"key": "opensearch:3",
"product": "opensearch",
"category": "database",
"cycle": "3",
"latest": "3.8.0",
"release_date": "2025-05-06",
"latest_release_date": "2026-08-05",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 1,
"critical": 0,
"high": 1,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-9624",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "python:3.13",
"product": "python",
"category": "programming",
"cycle": "3.13",
"latest": "3.13.15",
"release_date": "2024-10-07",
"latest_release_date": "2026-08-05",
"eol_date": "2029-10-31",
"support_date": "2026-10-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "python:3.14",
"product": "python",
"category": "programming",
"cycle": "3.14",
"latest": "3.14.7",
"release_date": "2025-10-07",
"latest_release_date": "2026-08-05",
"eol_date": "2030-10-31",
"support_date": "2027-10-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-06",
"key": "vue:3.5",
"product": "vue",
"category": "framework",
"cycle": "3.5",
"latest": "3.5.41",
"release_date": "2024-09-03",
"latest_release_date": "2026-08-05",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "amazon-linux:2",
"product": "amazon-linux",
"category": "os",
"cycle": "2",
"latest": "2.0.20260727.0",
"release_date": "2018-06-26",
"latest_release_date": "2026-08-04",
"eol_date": "2026-06-30",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "amazon-linux:2023",
"product": "amazon-linux",
"category": "os",
"cycle": "2023",
"latest": "2023.12.20260727.0",
"release_date": "2023-03-01",
"latest_release_date": "2026-08-04",
"eol_date": "2029-06-30",
"support_date": "2027-06-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-05",
"key": "django:5.2",
"product": "django",
"category": "framework",
"cycle": "5.2",
"latest": "5.2.17",
"release_date": "2025-04-02",
"latest_release_date": "2026-08-04",
"eol_date": "2028-04-30",
"support_date": "2025-12-03",
"is_major_product": true,
"cve_stats": {
"total": 25,
"critical": 2,
"high": 7,
"medium": 8,
"low": 8,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-4277",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-64459",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-3902",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-05",
"key": "django:6.0",
"product": "django",
"category": "framework",
"cycle": "6.0",
"latest": "6.0.8",
"release_date": "2025-12-03",
"latest_release_date": "2026-08-04",
"eol_date": "2027-04-30",
"support_date": "2026-08-31",
"is_major_product": true,
"cve_stats": {
"total": 25,
"critical": 2,
"high": 7,
"medium": 8,
"low": 8,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-4277",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-64459",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-3902",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-05",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.24.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-04",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-04",
"key": "gitlab:18.11",
"product": "gitlab",
"category": "devops",
"cycle": "18.11",
"latest": "18.11.8",
"release_date": "2026-04-16",
"latest_release_date": "2026-08-03",
"eol_date": "2026-07-16",
"support_date": "2026-05-21",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-9222",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-1090",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6073",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-04",
"key": "nodejs:24",
"product": "nodejs",
"category": "programming",
"cycle": "24",
"latest": "24.19.0",
"release_date": "2025-05-06",
"latest_release_date": "2026-08-03",
"eol_date": "2028-04-30",
"support_date": "2026-10-20",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-04",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.6.0",
"release_date": "2026-05-05",
"latest_release_date": "2026-08-03",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 3,
"high": 7,
"medium": 4,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-48930",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-55130",
"severity": "CRITICAL",
"score": 9.1
}
]
}
}
]
}