📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 19
|
対象期間 7日
|
生成 2026-08-18 11:00:52
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| python (3.10) | 3.10.21 | 2026-08-13 | 6 | 0 | 2 | 0 | 🟠重要 |
| python (3.11) | 3.11.16 | 2026-08-13 | 6 | 0 | 2 | 0 | 🟠重要 |
| gitlab (19.0) | 19.0.6 | 2026-08-12 | 171 | 0 | 51 | 0 | 🟠重要 |
| gitlab (19.1) | 19.1.4 | 2026-08-12 | 171 | 0 | 51 | 0 | 🟠重要 |
| tomcat (11.0) | 11.0.25 | 2026-08-12 | 15 | 4 | 7 | 1 | ⚠️要確認 |
| wordpress (6.8) | 6.8.8 | 2026-08-12 | 0 | 0 | 0 | 0 | ✅計画 |
| wordpress (6.9) | 6.9.7 | 2026-08-12 | 0 | 0 | 0 | 0 | ✅計画 |
| wordpress (7.0) | 7.0.4 | 2026-08-12 | 0 | 0 | 0 | 0 | ✅計画 |
| jenkins (2) | 2.577 | 2026-08-11 | 16 | 0 | 5 | 0 | 🟠重要 |
| postfix (3.10) | 3.10.13 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.11) | 3.11.6 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.9) | 3.9.14 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.8) | 3.8.20 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.7) | 3.7.22 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.6) | 3.6.20 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| postfix (3.5) | 3.5.27 | 2026-08-11 | 0 | 0 | 0 | 0 | ✅計画 |
| typo3 (13) | 13.4.34 | 2026-08-11 | 4 | 0 | 2 | 0 | 🟠重要 |
| typo3 (14) | 14.3.6 | 2026-08-11 | 4 | 0 | 2 | 0 | 🟠重要 |
非主要製品 の更新: 1件（firefox 153.0.4 — ブラウザ、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（補足: KEV 新規追加 3件はいずれも is_major_product=false のため ★★★ の条件を満たしませんが、tomcat 11.0.25 の cve_stats に KEV 該当 1件が含まれている点は、公式アドバイザリで対象 CVE を確認する必要がある可能性があります。個別 CVE ID がデータに含まれていないため、本表への掲載は保留しています。）
🟠 ★★ 参考 CVE
展開して表示 (3件)
📝 AI 全体サマリ
展開して読む
- tomcat 11.0.25 — cve_stats で critical 4件・KEV 1件が計上されています。上位 CVE（CVE-2026-59083 / CVE-2026-59084 / CVE-2025-66614、いずれも CVSS 9.1）の詳細と KEV 該当 CVE の特定は、Apache Tomcat 公式セキュリティページで確認することを推奨します。実運用で Tomcat 11.0 系を使っている場合は優先的な更新計画の対象になると考えられます。
- gitlab 19.0 系の EOL が 2026-08-20 — あと 2日で EOL を迎えます。19.0.6 は最終リリースの可能性が高く、19.1 系（EOL 2026-09-17）へのアップグレード、さらにその先のサイクルへの移行計画が必要と思われます。
- python 3.10 の EOL が 2026-10-31 — 3.10.21 が実質的に終盤のリリースになる見込みです。3.10 依存のプロジェクトがある場合、残り約 2.5 か月で 3.11 以降への移行検討が望ましいと考えられます。
- EOL 済みサイクルの更新が複数 — postfix 3.5（EOL 2024-03-06）/ 3.6（2025-02-16）/ 3.7（2026-03-06）、wordpress 6.8（2025-12-02）/ 6.9（2026-05-20）にも新バージョンが出ています。EOL 後のリリースは上流のバックポート提供状況によるため、自社で該当サイクルを使っていないか棚卸しする価値があります。
- gitlab の CVE 件数 171 は累積値の可能性 — 19.0 / 19.1 で数値が完全一致しており、当該リリースで修正された件数ではなく製品全体の累積集計を反映している可能性があります。解釈には注意が必要です。
```yaml
# docker-compose.yml — Tomcat 更新前後の比較用サンドボックス（骨子）
services:
tomcat-before:
image: tomcat:11.0.24-jre21 # 更新前（比較用）
ports: ["8080:8080"]
volumes:
- ./webapps:/usr/local/tomcat/webapps:ro
networks: [lab]
tomcat-after:
image: tomcat:11.0.25-jre21 # 更新後
ports: ["8081:8080"]
volumes:
- ./webapps:/usr/local/tomcat/webapps:ro
networks: [lab]
networks:
lab:
driver: bridge
internal: true # 外部到達を遮断し検証を隔離
```
検証時の観点: (1) 自社アプリの WAR が更新後も同一挙動か、(2) 公式アドバイザリに記載された影響条件（特定 Connector 設定・特定機能の有効化など）が自社構成に該当するか、(3) 該当する場合の暫定緩和（当該機能の無効化 / WAF でのパス制限）の実効性。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-12",
"to": "2026-08-18",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 19,
"by_date": {
"2026-08-14": {
"kev_new": 0,
"software_update": 2
},
"2026-08-13": {
"kev_new": 0,
"software_update": 6
},
"2026-08-12": {
"kev_new": 3,
"software_update": 11
}
}
},
"kev_new": [
{
"digest_date": "2026-08-12",
"key": "CVE-2026-20349",
"cve_id": "CVE-2026-20349",
"vendor_project": "Cisco",
"product": "Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ",
"vulnerability_name": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability",
"date_added": "2026-08-11",
"short_description": "Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-14",
"known_ransomware": "Unknown",
"cvss_score": 8.6,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. \r\n\r\nThis vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to t",
"epss_score": null
},
{
"digest_date": "2026-08-12",
"key": "CVE-2026-68820",
"cve_id": "CVE-2026-68820",
"vendor_project": "Microsoft",
"product": "Windows Ancillary Function Driver for WinSock ",
"vulnerability_name": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
"date_added": "2026-08-11",
"short_description": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-25",
"known_ransomware": "Unknown",
"cvss_score": 7.0,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "L",
"is_remote": false,
"is_major_product": false,
"matched_product": null,
"title_en": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
"epss_score": null
},
{
"digest_date": "2026-08-12",
"key": "CVE-2026-72898",
"cve_id": "CVE-2026-72898",
"vendor_project": "Metabase",
"product": "Metabase",
"vulnerability_name": "Metabase SQL Injection Vulnerability",
"date_added": "2026-08-11",
"short_description": "Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-14",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.",
"epss_score": 0.0069
}
],
"software_update": [
{
"digest_date": "2026-08-14",
"key": "python:3.10",
"product": "python",
"category": "programming",
"cycle": "3.10",
"latest": "3.10.21",
"release_date": "2021-10-04",
"latest_release_date": "2026-08-13",
"eol_date": "2026-10-31",
"support_date": "2023-04-05",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-14",
"key": "python:3.11",
"product": "python",
"category": "programming",
"cycle": "3.11",
"latest": "3.11.16",
"release_date": "2022-10-24",
"latest_release_date": "2026-08-13",
"eol_date": "2027-10-31",
"support_date": "2024-04-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "gitlab:19.0",
"product": "gitlab",
"category": "devops",
"cycle": "19.0",
"latest": "19.0.6",
"release_date": "2026-05-21",
"latest_release_date": "2026-08-12",
"eol_date": "2026-08-20",
"support_date": "2026-06-18",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-12716",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "gitlab:19.1",
"product": "gitlab",
"category": "devops",
"cycle": "19.1",
"latest": "19.1.4",
"release_date": "2026-06-18",
"latest_release_date": "2026-08-12",
"eol_date": "2026-09-17",
"support_date": "2026-07-16",
"is_major_product": true,
"cve_stats": {
"total": 171,
"critical": 0,
"high": 51,
"medium": 92,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-7377",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2025-12716",
"severity": "HIGH",
"score": 8.7
},
{
"cve_id": "CVE-2026-6552",
"severity": "HIGH",
"score": 8.7
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "tomcat:11.0",
"product": "tomcat",
"category": "webserver",
"cycle": "11.0",
"latest": "11.0.25",
"release_date": "2024-10-03",
"latest_release_date": "2026-08-12",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 15,
"critical": 4,
"high": 7,
"medium": 3,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-59083",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-59084",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2025-66614",
"severity": "CRITICAL",
"score": 9.1
}
]
}
},
{
"digest_date": "2026-08-13",
"key": "wordpress:6.8",
"product": "wordpress",
"category": "cms",
"cycle": "6.8",
"latest": "6.8.8",
"release_date": "2025-04-15",
"latest_release_date": "2026-08-12",
"eol_date": "2025-12-02",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-13",
"key": "wordpress:6.9",
"product": "wordpress",
"category": "cms",
"cycle": "6.9",
"latest": "6.9.7",
"release_date": "2025-12-02",
"latest_release_date": "2026-08-12",
"eol_date": "2026-05-20",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-13",
"key": "wordpress:7.0",
"product": "wordpress",
"category": "cms",
"cycle": "7.0",
"latest": "7.0.4",
"release_date": "2026-05-20",
"latest_release_date": "2026-08-12",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.0.4",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.577",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.10",
"product": "postfix",
"category": "middleware",
"cycle": "3.10",
"latest": "3.10.13",
"release_date": "2025-02-16",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.11",
"product": "postfix",
"category": "middleware",
"cycle": "3.11",
"latest": "3.11.6",
"release_date": "2026-03-06",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.5",
"product": "postfix",
"category": "middleware",
"cycle": "3.5",
"latest": "3.5.27",
"release_date": "2020-03-15",
"latest_release_date": "2026-08-11",
"eol_date": "2024-03-06",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.6",
"product": "postfix",
"category": "middleware",
"cycle": "3.6",
"latest": "3.6.20",
"release_date": "2021-04-29",
"latest_release_date": "2026-08-11",
"eol_date": "2025-02-16",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.7",
"product": "postfix",
"category": "middleware",
"cycle": "3.7",
"latest": "3.7.22",
"release_date": "2022-02-06",
"latest_release_date": "2026-08-11",
"eol_date": "2026-03-06",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.8",
"product": "postfix",
"category": "middleware",
"cycle": "3.8",
"latest": "3.8.20",
"release_date": "2023-04-17",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "postfix:3.9",
"product": "postfix",
"category": "middleware",
"cycle": "3.9",
"latest": "3.9.14",
"release_date": "2024-03-06",
"latest_release_date": "2026-08-11",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-12",
"key": "typo3:13",
"product": "typo3",
"category": "cms",
"cycle": "13",
"latest": "13.4.34",
"release_date": "2024-01-30",
"latest_release_date": "2026-08-11",
"eol_date": "2027-12-31",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 2,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-59022",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2026-0859",
"severity": "HIGH",
"score": 7.8
},
{
"cve_id": "CVE-2025-59020",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-12",
"key": "typo3:14",
"product": "typo3",
"category": "cms",
"cycle": "14",
"latest": "14.3.6",
"release_date": "2025-11-25",
"latest_release_date": "2026-08-11",
"eol_date": "2029-06-30",
"support_date": "2027-12-31",
"is_major_product": true,
"cve_stats": {
"total": 4,
"critical": 0,
"high": 2,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-59022",
"severity": "HIGH",
"score": 8.1
},
{
"cve_id": "CVE-2026-0859",
"severity": "HIGH",
"score": 7.8
},
{
"cve_id": "CVE-2025-59020",
"severity": "MEDIUM",
"score": 6.5
}
]
}
}
]
}