📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 19
|
対象期間 7日
|
生成 2026-08-17 11:01:01
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| python (3.10) | 3.10.21 | 2026-08-13 | 6 | 0 | 2 | 0 | 🟠重要 |
| python (3.11) | 3.11.16 | 2026-08-13 | 6 | 0 | 2 | 0 | 🟠重要 |
| gitlab (19.0) | 19.0.6 | 2026-08-12 | 171 | 0 | 51 | 0 | 🟠重要 |
| gitlab (19.1) | 19.1.4 | 2026-08-12 | 171 | 0 | 51 | 0 | 🟠重要 |
| tomcat (11.0) | 11.0.25 | 2026-08-12 | 15 | 4 | 7 | 1 | ⚠️要確認 |
| wordpress (6.8) | 6.8.8 | 2026-08-12 | 0 | 0 | 0 | 0 | ✅計画 |
| wordpress (6.9) | 6.9.7 | 2026-08-12 | 0 | 0 | 0 | 0 | ✅計画 |
| wordpress (7.0) | 7.0.4 | 2026-08-12 | 0 | 0 | 0 | 0 | ✅計画 |
| jenkins (2) | 2.577 | 2026-08-11 | 16 | 0 | 5 | 0 | 🟠重要 |
| postfix (3.11) | 3.11.6 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.10) | 3.10.13 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.9) | 3.9.14 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.8) | 3.8.20 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.7) | 3.7.22 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.6) | 3.6.20 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.5) | 3.5.27 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| typo3 (14) | 14.3.6 | 2026-08-11 | 4 | 0 | 2 | 0 | 🟠重要 |
| typo3 (13) | 13.4.34 | 2026-08-11 | 4 | 0 | 2 | 0 | 🟠重要 |
非主要製品 の更新: 1件（firefox 153.0.4 / ブラウザ・クライアント系のため、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
is_major_product=false のため、方針上 ★★★ の条件（is_major_product=true が前提）を満たしていません。kev: 1 が含まれており、これは自社運用対象の主要製品に KEV 該当 CVE が存在する可能性を示します。入力データに該当 CVE ID が含まれていないため断定はできませんが、Apache Tomcat の公式アドバイザリおよび CISA KEV カタログでの突合を優先的に実施することを推奨します（実質的な優先度は ★★★ 相当として扱う余地があります）。🟠 ★★ 参考 CVE
展開して表示 (2件)
★ その他（参考）
📝 AI 全体サマリ
展開して読む
全体トレンド (2026-08-11 〜 2026-08-17)
今週は「主要製品側は Critical 少なめ、KEV 側は自社対象外」という分離した傾向が見られます。KEV 新規登録は 3件で、Cisco ASA/FTD（DoS）・Windows AFD（ローカル EoP）・Metabase（SQLi, CVSS 10.0）と、いずれも自社の運用対象辞書には該当しません。一方で更新側は Tomcat 11.0.25 が Critical 4件・KEV 1件を含む集計となっており、今週の実質的な最優先候補は Tomcat の更新確認である可能性が高いと考えられます。GitLab は 171件という大きな累積 CVE 件数ですが Critical 0 / High 51 であり、これは累積集計値と見られるため、実際の対応判断は 19.0.6 / 19.1.4 のリリースノート差分で確認するのが適切です。
特記事項
eol_date が文字列 "false" で入っており、他レコードと表現が揺れています。集計スクリプト側で真偽値／文字列の混在を扱えているか、念のため確認の余地があります。PoC 検証を推奨する CVE
現時点で ★★★ 該当がないため、緊急の PoC 検証対象はありません。ただし Tomcat 11.0 系の Critical 群（CVE-2026-59083 / CVE-2026-59084 / CVE-2025-66614、いずれも CVSS 9.1） について、公式アドバイザリで自社構成（利用中のコネクタ・バージョン・設定）が影響範囲に入るか確認した上で、必要なら検証環境で挙動確認を行う流れが妥当と考えられます。以下は検証環境の骨子のみを示すもので、攻撃コードは含みません。
# docker-compose.yml (検証用・骨子)
services:
tomcat-vuln:
image: tomcat:11.0.24-jdk21 # 更新前バージョン（要確認）
ports: ["18080:8080"]
volumes:
- ./conf/server.xml:/usr/local/tomcat/conf/server.xml:ro
- ./webapps:/usr/local/tomcat/webapps
networks: [lab]
tomcat-fixed:
image: tomcat:11.0.25-jdk21 # 更新後バージョン
ports: ["18081:8080"]
volumes:
- ./conf/server.xml:/usr/local/tomcat/conf/server.xml:ro
- ./webapps:/usr/local/tomcat/webapps
networks: [lab]
networks:
lab:
driver: bridge # 外部から到達しない隔離ネットワークで実施
検証手順の骨子:
1. 公式アドバイザリ（Apache Tomcat security pages）で対象 CVE の影響条件（コネクタ種別、設定パラメータ等）を特定する
2. 上記の影響条件を server.xml に反映し、更新前／更新後の 2 コンテナで挙動差分を観察する
3. 検証は隔離ネットワーク内に限定し、本番相当データは投入しない
4. 結果は「自社構成が影響条件に該当するか / しないか」の判定に留め、判定できない場合は Tomcat 11.0.25 への更新を計画適用として扱う
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-11",
"to": "2026-08-17",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 19,
"by_date": {
"2026-08-14": {
"kev_new": 0,
"software_update": 2
},
"2026-08-13": {
"kev_new": 0,
"software_update": 6
},
"2026-08-12": {
"kev_new": 3,
"software_update": 11
}
}
},
"kev_new": [
{
"digest_date": "2026-08-12",
"key": "CVE-2026-20349",
"cve_id": "CVE-2026-20349",
"vendor_project": "Cisco",
"product": "Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ",
"vulnerability_name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability",
"date_added": "2026-08-11",
"short_description": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-14",
"known_ransomware": "Unknown",
"cvss_score": 8.6,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. \r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to t",
"epss_score": null
},
{
"digest_date": "2026-08-12",
"key": "CVE-2026-68820",
"cve_id": "CVE-2026-68820",
"vendor_project": "Microsoft",
"product": "Windows Ancillary Function Driver for WinSock ",
"vulnerability_name": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
"date_added": "2026-08-11",
"short_description": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-25",
"known_ransomware": "Unknown",
"cvss_score": 7.0,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "L",
"is_remote": false,
"is_major_product": false,
"matched_product": null,
"title_en": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
"epss_score": null
},
{
"digest_date": "2026-08-12",
"key": "CVE-2026-72898",
"cve_id": "CVE-2026-72898",
"vendor_project": "Metabase",
"product": "Metabase",
"vulnerability_name": "Metabase SQL Injection Vulnerability",
"date_added": "2026-08-11",
"short_description": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-14",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.",
"epss_score": 0.0069
}
],
"software_update": [
{
"digest_date": "2026-08-14",
"key": "python:3.10",
"product": "python",
"category": "programming",
"cycle": "3.10",
"latest": "3.10.21",
"release_date": "2021-10-04",
"latest_release_date": "2026-08-13",
"eol_date": "2026-10-31",
"support_date": "2023-04-05",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-14",
"key": "python:3.11",
"product": "python",
"category": "programming",
"cycle": "3.11",
"latest": "3.11.16",
"release_date": "2022-10-24",
"latest_release_date": "2026-08-13",
"eol_date": "2027-10-31",
"support_date": "2024-04-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "gitlab:19.0",
"product": "gitlab",
"category": "devops",
"cycle": "19.0",
"latest": "19.0.6",
"release_date": "2026-05-21",
"latest_release_date": "2026-08-12",
"eol_date": "2026-08-20",
"support_date": "2026-06-18",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-12716",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "gitlab:19.1",
"product": "gitlab",
"category": "devops",
"cycle": "19.1",
"latest": "19.1.4",
"release_date": "2026-06-18",
"latest_release_date": "2026-08-12",
"eol_date": "2026-09-17",
"support_date": "2026-07-16",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-12716",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "tomcat:11.0",
"product": "tomcat",
"category": "webserver",
"cycle": "11.0",
"latest": "11.0.25",
"release_date": "2024-10-03",
"latest_release_date": "2026-08-12",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 15,
"critical": 4,
"high": 7,
"medium": 3,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-59083",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-59084",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2025-66614",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "wordpress:6.8",
"product": "wordpress",
"category": "cms",
"cycle": "6.8",
"latest": "6.8.8",
"release_date": "2025-04-15",
"latest_release_date": "2026-08-12",
"eol_date": "2025-12-02",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-13",
"key": "wordpress:6.9",
"product": "wordpress",
"category": "cms",
"cycle": "6.9",
"latest": "6.9.7",
"release_date": "2025-12-02",
"latest_release_date": "2026-08-12",
"eol_date": "2026-05-20",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-13",
"key": "wordpress:7.0",
"product": "wordpress",
"category": "cms",
"cycle": "7.0",
"latest": "7.0.4",
"release_date": "2026-05-20",
"latest_release_date": "2026-08-12",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.0.4",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.577",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.10",
"product": "postfix",
"category": "middleware",
"cycle": "3.10",
"latest": "3.10.13",
"release_date": "2025-02-16",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.11",
"product": "postfix",
"category": "middleware",
"cycle": "3.11",
"latest": "3.11.6",
"release_date": "2026-03-06",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.5",
"product": "postfix",
"category": "middleware",
"cycle": "3.5",
"latest": "3.5.27",
"release_date": "2020-03-15",
"latest_release_date": "2026-08-11",
"eol_date": "2024-03-06",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.6",
"product": "postfix",
"category": "middleware",
"cycle": "3.6",
"latest": "3.6.20",
"release_date": "2021-04-29",
"latest_release_date": "2026-08-11",
"eol_date": "2025-02-16",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.7",
"product": "postfix",
"category": "middleware",
"cycle": "3.7",
"latest": "3.7.22",
"release_date": "2022-02-06",
"latest_release_date": "2026-08-11",
"eol_date": "2026-03-06",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.8",
"product": "postfix",
"category": "middleware",
"cycle": "3.8",
"latest": "3.8.20",
"release_date": "2023-04-17",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.9",
"product": "postfix",
"category": "middleware",
"cycle": "3.9",
"latest": "3.9.14",
"release_date": "2024-03-06",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "typo3:13",
"product": "typo3",
"category": "cms",
"cycle": "13",
"latest": "13.4.34",
"release_date": "2024-01-30",
"latest_release_date": "2026-08-11",
"eol_date": "2027-12-31",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 2,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-59022",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2026-0859",
"severity": "HIGH",
"score": 7.8
},
{
"cve_id": "CVE-2025-59020",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-12",
"key": "typo3:14",
"product": "typo3",
"category": "cms",
"cycle": "14",
"latest": "14.3.6",
"release_date": "2025-11-25",
"latest_release_date": "2026-08-11",
"eol_date": "2029-06-30",
"support_date": "2027-12-31",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 2,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-59022",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2026-0859",
"severity": "HIGH",
"score": 7.8
},
{
"cve_id": "CVE-2025-59020",
"severity": "MEDIUM",
"score": 6.5
}
]
}
}
]
}