📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 4
|
更新ソフト 21
|
対象期間 7日
|
生成 2026-08-13 14:36:30
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| jenkins | 2.577 | 2026-08-11 | 16 | 0 | 5 | 0 | 🟠重要 |
| typo3 | 13.4.34 | 2026-08-11 | 4 | 0 | 2 | 0 | 🟠重要 |
| typo3 | 14.3.6 | 2026-08-11 | 4 | 0 | 2 | 0 | 🟠重要 |
| postfix | 3.11.6 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix | 3.10.13 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix | 3.9.14 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix | 3.8.20 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix | 3.7.22 (EOL済) | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix | 3.6.20 (EOL済) | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix | 3.5.27 (EOL済) | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| symfony | 7.4.16 | 2026-08-07 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| symfony | 8.1.4 | 2026-08-07 | 30 | 3 | 13 | 0 | ⚠️要確認 |
| apache-cassandra | 5.0.9 | 2026-08-07 | 3 | 0 | 1 | 0 | 🟠重要 |
| apache-cassandra | 4.1.12 | 2026-08-07 | 3 | 0 | 1 | 0 | 🟠重要 |
| apache-cassandra | 4.0.21 | 2026-08-07 | 3 | 0 | 1 | 0 | 🟠重要 |
| angular | 22.1.1 | 2026-08-07 | 4 | 0 | 0 | 0 | ✅計画 |
| apache-activemq | 6.3.1 | 2026-08-06 | 13 | 0 | 7 | 1 | ⚠️要確認 |
| gitlab | 18.11.9 | 2026-08-06 | 171 | 0 | 51 | 0 | 🟠重要 |
| drupal | 11.4.5 | 2026-08-06 | 7 | 0 | 0 | 0 | ✅計画 |
| drupal | 10.6.15 | 2026-08-06 | 7 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 1件（firefox 153.0.4 / OS ディストリ・Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
今回 KEV に新規追載された 4 件はいずれも is_major_product=false（Cisco ASA/FTD・Windows AFD ドライバ・Metabase・Progress LoadMaster）で、自社の運用対象製品には該当しない可能性が高いため ★★★ には分類されませんでした。ただし apache-activemq 6.3.1 の CVE 統計には kev=1 が含まれており、該当 CVE ID がデータ中に展開されていないため、公式アドバイザリで KEV 該当 CVE の特定を推奨します。
🟠 ★★ 参考 CVE
展開して表示 (7件)
is_remote 情報がデータに含まれていないため暫定的に ★★ に分類しているが、リモート悪用可能であれば ★★★ 相当に格上げされる可能性がある。公式セキュリティアドバイザリでの確認を強く推奨。📝 AI 全体サマリ
展開して読む
- Symfony 7.4.16 / 8.1.4 — Critical 3 件（最大 CVSS 9.8）。PHP アプリの依存として間接的に入っているケースもあるため、composer.lock ベースでの棚卸しを推奨します。
- apache-activemq 6.3.1 — cve_stats.kev=1 が立っており、既知悪用 CVE を含む可能性があります。CVE ID がダイジェストに展開されていないため、Apache ActiveMQ の公式アドバイザリで特定してください。
- postfix の EOL サイクル — 3.5 / 3.6 / 3.7 系は既にサポート終了（それぞれ 2024-03-06 / 2025-02-16 / 2026-03-06）にもかかわらず更新が出ています。今回は CVE 0 件ですが、EOL 系統を運用中の場合は 3.10 / 3.11 系への移行計画を立てておくのが安全と考えられます。
- gitlab 18.11.9 — CVE 総数 171 件（High 51）は累積カウントである可能性が高く、今回の差分すべてが新規とは限りません。加えて 18.11 系は EOL 日が 2026-07-16 と過去日付になっているため、サポート対象サイクルへのアップグレード検討を推奨します。
- typo3 / drupal / angular — Critical なし。計画的な定期適用で問題ないと見られます。
# docker-compose.yml （検証環境の骨子 / 外部公開しないこと）
services:
app-vuln:
image: php:8.3-cli
working_dir: /app
# 脆弱バージョン: composer create-project symfony/skeleton:^7.4 で 7.4.15 を pin
command: php -S 0.0.0.0:8000 -t public
networks: [poc]
# ports は開けず、network 内の tester からのみアクセスする
app-fixed:
image: php:8.3-cli
working_dir: /app
# 修正版: 7.4.16 を pin し、同一リクエストでの挙動差分を比較
command: php -S 0.0.0.0:8000 -t public
networks: [poc]
tester:
image: curlimages/curl:latest
# 公式アドバイザリ記載の条件に沿ったリクエストを vuln / fixed 双方へ投げ、
# レスポンス・ログの差分のみを観測する
networks: [poc]
networks:
poc:
internal: true # 外部へ出さない
検証の流れは「①脆弱版で該当コードパスが有効かをアプリログで確認 → ②修正版で同条件を再実行し差分を取得 → ③自社アプリの composer.lock が該当バージョン範囲かを照合」の 3 段で足りると考えられます。実際の攻撃条件（認証要否・必要な設定）は Symfony 公式セキュリティアドバイザリで確認してください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-07",
"to": "2026-08-13",
"days": 7
},
"summary": {
"total_kev_new": 4,
"total_software_update": 21,
"by_date": {
"2026-08-12": {
"kev_new": 3,
"software_update": 11
},
"2026-08-08": {
"kev_new": 1,
"software_update": 6
},
"2026-08-07": {
"kev_new": 0,
"software_update": 4
}
}
},
"kev_new": [
{
"digest_date": "2026-08-12",
"key": "CVE-2026-20349",
"cve_id": "CVE-2026-20349",
"vendor_project": "Cisco",
"product": "Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ",
"vulnerability_name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability",
"date_added": "2026-08-11",
"short_description": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-14",
"known_ransomware": "Unknown",
"cvss_score": 8.6,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. \r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to t",
"epss_score": null
},
{
"digest_date": "2026-08-12",
"key": "CVE-2026-68820",
"cve_id": "CVE-2026-68820",
"vendor_project": "Microsoft",
"product": "Windows Ancillary Function Driver for WinSock ",
"vulnerability_name": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
"date_added": "2026-08-11",
"short_description": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-25",
"known_ransomware": "Unknown",
"cvss_score": 7.0,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "L",
"is_remote": false,
"is_major_product": false,
"matched_product": null,
"title_en": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
"epss_score": null
},
{
"digest_date": "2026-08-12",
"key": "CVE-2026-72898",
"cve_id": "CVE-2026-72898",
"vendor_project": "Metabase",
"product": "Metabase",
"vulnerability_name": "Metabase SQL Injection Vulnerability",
"date_added": "2026-08-11",
"short_description": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-14",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.",
"epss_score": 0.0069
},
{
"digest_date": "2026-08-08",
"key": "CVE-2026-8037",
"cve_id": "CVE-2026-8037",
"vendor_project": "Progress",
"product": "LoadMaster",
"vulnerability_name": "Progress LoadMaster Command Injection Vulnerability",
"date_added": "2026-08-07",
"short_description": "Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-10",
"known_ransomware": "Unknown",
"cvss_score": 9.6,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "A",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints",
"epss_score": 0.84793
}
],
"software_update": [
{
"digest_date": "2026-08-12",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.0.4",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.577",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.10",
"product": "postfix",
"category": "middleware",
"cycle": "3.10",
"latest": "3.10.13",
"release_date": "2025-02-16",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.11",
"product": "postfix",
"category": "middleware",
"cycle": "3.11",
"latest": "3.11.6",
"release_date": "2026-03-06",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.5",
"product": "postfix",
"category": "middleware",
"cycle": "3.5",
"latest": "3.5.27",
"release_date": "2020-03-15",
"latest_release_date": "2026-08-11",
"eol_date": "2024-03-06",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.6",
"product": "postfix",
"category": "middleware",
"cycle": "3.6",
"latest": "3.6.20",
"release_date": "2021-04-29",
"latest_release_date": "2026-08-11",
"eol_date": "2025-02-16",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.7",
"product": "postfix",
"category": "middleware",
"cycle": "3.7",
"latest": "3.7.22",
"release_date": "2022-02-06",
"latest_release_date": "2026-08-11",
"eol_date": "2026-03-06",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.8",
"product": "postfix",
"category": "middleware",
"cycle": "3.8",
"latest": "3.8.20",
"release_date": "2023-04-17",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.9",
"product": "postfix",
"category": "middleware",
"cycle": "3.9",
"latest": "3.9.14",
"release_date": "2024-03-06",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "typo3:13",
"product": "typo3",
"category": "cms",
"cycle": "13",
"latest": "13.4.34",
"release_date": "2024-01-30",
"latest_release_date": "2026-08-11",
"eol_date": "2027-12-31",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 2,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-59022",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2026-0859",
"severity": "HIGH",
"score": 7.8
},
{
"cve_id": "CVE-2025-59020",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-12",
"key": "typo3:14",
"product": "typo3",
"category": "cms",
"cycle": "14",
"latest": "14.3.6",
"release_date": "2025-11-25",
"latest_release_date": "2026-08-11",
"eol_date": "2029-06-30",
"support_date": "2027-12-31",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 2,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-59022",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2026-0859",
"severity": "HIGH",
"score": 7.8
},
{
"cve_id": "CVE-2025-59020",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "angular:22",
"product": "angular",
"category": "framework",
"cycle": "22",
"latest": "22.1.1",
"release_date": "2026-06-03",
"latest_release_date": "2026-08-07",
"eol_date": "2028-06-30",
"support_date": "2027-06-30",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 0,
"medium": 4,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27970",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-22610",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2025-61261",
"severity": "MEDIUM",
"score": 5.4
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "apache-cassandra:4.0",
"product": "apache-cassandra",
"category": "database",
"cycle": "4.0",
"latest": "4.0.21",
"release_date": "2021-07-26",
"latest_release_date": "2026-08-07",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27314",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-32588",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2026-27315",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "apache-cassandra:4.1",
"product": "apache-cassandra",
"category": "database",
"cycle": "4.1",
"latest": "4.1.12",
"release_date": "2022-12-13",
"latest_release_date": "2026-08-07",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27314",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-32588",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2026-27315",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "apache-cassandra:5.0",
"product": "apache-cassandra",
"category": "database",
"cycle": "5.0",
"latest": "5.0.9",
"release_date": "2024-09-05",
"latest_release_date": "2026-08-07",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 3,
"critical": 0,
"high": 1,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-27314",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-32588",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2026-27315",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "symfony:7.4",
"product": "symfony",
"category": "framework",
"cycle": "7.4",
"latest": "7.4.16",
"release_date": "2025-11-27",
"latest_release_date": "2026-08-07",
"eol_date": "2029-11-30",
"support_date": "2028-11-30",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-08",
"key": "symfony:8.1",
"product": "symfony",
"category": "framework",
"cycle": "8.1",
"latest": "8.1.4",
"release_date": "2026-05-29",
"latest_release_date": "2026-08-07",
"eol_date": "2027-01-31",
"support_date": "2027-01-31",
"is_major_product": true,
"cve_stats": {
"total": 30,
"critical": 3,
"high": 13,
"medium": 14,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-47767",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-45069",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-45063",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "apache-activemq:6.3",
"product": "apache-activemq",
"category": "middleware",
"cycle": "6.3",
"latest": "6.3.1",
"release_date": "2026-07-24",
"latest_release_date": "2026-08-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 13,
"critical": 0,
"high": 7,
"medium": 6,
"low": 0,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-49157",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-40466",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-45505",
"severity": "HIGH",
"score": 8.8
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "drupal:10.6",
"product": "drupal",
"category": "cms",
"cycle": "10.6",
"latest": "10.6.15",
"release_date": "2025-12-17",
"latest_release_date": "2026-08-06",
"eol_date": "2026-12-16",
"support_date": "2026-06-16",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "drupal:11.4",
"product": "drupal",
"category": "cms",
"cycle": "11.4",
"latest": "11.4.5",
"release_date": "2026-07-01",
"latest_release_date": "2026-08-06",
"eol_date": "2027-07-07",
"support_date": "2027-01-01",
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 0,
"high": 0,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-6366",
"severity": "MEDIUM",
"score": 6.6
},
{
"cve_id": "CVE-2026-6367",
"severity": "MEDIUM",
"score": 6.1
},
{
"cve_id": "CVE-2026-6365",
"severity": "MEDIUM",
"score": 6.1
}
]
}
},
{
"digest_date": "2026-08-07",
"key": "gitlab:18.11",
"product": "gitlab",
"category": "devops",
"cycle": "18.11",
"latest": "18.11.9",
"release_date": "2026-04-16",
"latest_release_date": "2026-08-06",
"eol_date": "2026-07-16",
"support_date": "2026-05-21",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-9222",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
}
]
}