📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 10
|
対象期間 7日
|
生成 2026-08-20 11:00:46
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| traefik | 2.11.55 | 2026-08-18 | 20 | 3 | 7 | 0 | ⚠️要確認 |
| joomla | 6.1.3 | 2026-08-18 | 34 | 6 | 7 | 0 | ⚠️要確認 |
| jenkins | 2.578 | 2026-08-18 | 16 | 0 | 5 | 0 | 🟠重要 |
| virtualbox | 7.2.16 | 2026-08-18 | 33 | 0 | 19 | 0 | 🟠重要 |
| laravel | 12.67.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| laravel | 13.26.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| python | 3.10.21 | 2026-08-13 | 6 | 0 | 2 | 0 | 🟠重要 |
| python | 3.11.16 | 2026-08-13 | 6 | 0 | 2 | 0 | 🟠重要 |
非主要製品 の更新: 2件（firefox 140.14.0 / 153.1.0 — ブラウザ系、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（KEV 新規 5 件のうち is_major_product=true は CVE-2026-65400 (Apple macOS) のみですが、CVSS 7.1 で ★★★ の閾値には達していないため ★★ 扱いとしています。ただし KEV 登録済みである点は留意が必要です。）
🟠 ★★ 参考 CVE
展開して表示 (4件)
※ CVE-2025-62593 (Ray-Project Ray, CVSS 9.4, KEV) は CVSS 9.5 未満・非主要製品のため方針上 ★ その他に分類されますが、KEV 新規登録であり、機械学習基盤で Ray を利用している場合はブラウザ経由の悪用が指摘されているため公式アドバイザリで確認をおすすめします。
📝 AI 全体サマリ
展開して読む
- traefik 2.11 系は eol_date が 2026-02-01 で既に EOL を過ぎている可能性があります。CVSS 10.0 級の Critical が 3 件（CVE-2026-39858 / CVE-2026-35051 / CVE-2026-54763）計上されている点も踏まえ、パッチ適用ではなくサポート中のメジャー系列（3.x 等）への移行計画を検討すべき状況と考えられます。公式リリースノートで EOL 状況を確認してください。
- python 3.10 系も eol_date 2026-10-31 と残り約 2 か月です。3.11 以降への移行スケジュールを立てる時期の可能性があります。
- joomla 6.1.3 は Critical 6 件（CVSS 9.8 級 3 件）を含みます。自社で Joomla を公開運用している場合は優先度を上げる価値がある可能性があります。
- jenkins 2.578 は High 5 件（CVE-2026-33001 / CVE-2026-53435 いずれも 8.8）で、CI 基盤は内部ネットワーク限定でも認証済みユーザ経由の権限昇格に注意が必要な可能性があります。
最も検証価値が高いのは traefik 系の Critical（CVE-2026-39858 等）と考えられます。自社で reverse proxy として利用している構成に近い形で隔離環境を作り、公式アドバイザリ記載の影響条件（該当ミドルウェア・プラグイン設定の有無）に自社設定が合致するかを確認する用途に留めるのが安全です。
```yaml
# 検証用 骨子（隔離ネットワーク前提・インターネット非公開）
services:
traefik-vuln:
image: traefik:2.11.54 # 修正前バージョンで再現条件を確認
command:
- --api.insecure=true
- --providers.docker=true
- --entrypoints.web.address=:80
ports: ["8080:8080", "8000:80"]
volumes: ["/var/run/docker.sock:/var/run/docker.sock:ro"]
networks: [lab]
traefik-fixed:
image: traefik:2.11.55 # 修正後との差分比較用
command: ["--api.insecure=true", "--providers.docker=true"]
networks: [lab]
backend:
image: traefik/whoami
labels: ["traefik.http.routers.whoami.rule=Host(whoami.lab)"]
networks: [lab]
networks:
lab:
internal: true # 外部到達不可にする
```
検証は「自社設定が影響条件に該当するか」の切り分けまでとし、攻撃コードの作成は行わない方針とします。実際の再現手順は公式アドバイザリおよびベンダ提供の情報で確認してください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-14",
"to": "2026-08-20",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 10,
"by_date": {
"2026-08-19": {
"kev_new": 4,
"software_update": 8
},
"2026-08-18": {
"kev_new": 1,
"software_update": 0
},
"2026-08-14": {
"kev_new": 0,
"software_update": 2
}
}
},
"kev_new": [
{
"digest_date": "2026-08-19",
"key": "CVE-2026-33824",
"cve_id": "CVE-2026-33824",
"vendor_project": "Microsoft",
"product": "Internet Key Exchange (IKE) Service Extensions",
"vulnerability_name": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.5585
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-55040",
"cve_id": "CVE-2026-55040",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Weak Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.1,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.",
"epss_score": 0.03971
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-59310",
"cve_id": "CVE-2026-59310",
"vendor_project": "Broadcom",
"product": "VMware vCenter",
"vulnerability_name": "Broadcom VMware vCenter Path Traversal Vulnerability",
"date_added": "2026-08-18",
"short_description": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.",
"epss_score": 0.0114
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-65400",
"cve_id": "CVE-2026-65400",
"vendor_project": "Apple",
"product": "macOS",
"vulnerability_name": "Apple macOS Improper Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 7.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "macos",
"title_en": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.",
"epss_score": 0.00496
},
{
"digest_date": "2026-08-18",
"key": "CVE-2025-62593",
"cve_id": "CVE-2025-62593",
"vendor_project": "Ray-Project",
"product": "Ray",
"vulnerability_name": "Ray-Project Ray Code Injection Vulnerability",
"date_added": "2026-08-17",
"short_description": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-20",
"known_ransomware": "Unknown",
"cvss_score": 9.4,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string \"Mozilla\" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DN",
"epss_score": 0.00369
}
],
"software_update": [
{
"digest_date": "2026-08-19",
"key": "firefox:140",
"product": "firefox",
"category": "browser",
"cycle": "140",
"latest": "140.14.0",
"release_date": "2025-06-24",
"latest_release_date": "2026-08-18",
"eol_date": "2026-09-29",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.1.0",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.578",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "joomla:6",
"product": "joomla",
"category": "cms",
"cycle": "6",
"latest": "6.1.3",
"release_date": "2025-10-14",
"latest_release_date": "2026-08-18",
"eol_date": "2029-10-16",
"support_date": "2028-10-17",
"is_major_product": true,
"cve_stats": {
"total": 34,
"critical": 6,
"high": 7,
"medium": 21,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40383",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48898",
"severity": "CRITICAL",
"score": 9.8
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.67.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-18",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.26.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-18",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "traefik:2.11",
"product": "traefik",
"category": "webserver",
"cycle": "2.11",
"latest": "2.11.55",
"release_date": "2024-02-12",
"latest_release_date": "2026-08-18",
"eol_date": "2026-02-01",
"support_date": "2025-04-29",
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 3,
"high": 7,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-39858",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-35051",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-54763",
"severity": "CRITICAL",
"score": 10.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "virtualbox:7.2",
"product": "virtualbox",
"category": "virtualization",
"cycle": "7.2",
"latest": "7.2.16",
"release_date": "2025-08-14",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 33,
"critical": 0,
"high": 19,
"medium": 8,
"low": 6,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21955",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21988",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21987",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-14",
"key": "python:3.10",
"product": "python",
"category": "programming",
"cycle": "3.10",
"latest": "3.10.21",
"release_date": "2021-10-04",
"latest_release_date": "2026-08-13",
"eol_date": "2026-10-31",
"support_date": "2023-04-05",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-14",
"key": "python:3.11",
"product": "python",
"category": "programming",
"cycle": "3.11",
"latest": "3.11.16",
"release_date": "2022-10-24",
"latest_release_date": "2026-08-13",
"eol_date": "2027-10-31",
"support_date": "2024-04-01",
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 2,
"medium": 3,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-13836",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-15308",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-13837",
"severity": "MEDIUM",
"score": 5.5
}
]
}
}
]
}