📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 6
|
更新ソフト 15
|
対象期間 7日
|
生成 2026-08-21 11:00:54
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| eclipse-temurin (17) | 17.0.20.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (21) | 21.0.12.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (25) | 25.0.4.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| go (1.25) | 1.25.14 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| go (1.26) | 1.26.7 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| microsoft-build-of-openjdk (11) | 11.0.32.1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| nginx (1.31) | 1.31.4 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| jenkins (2) | 2.578 | 2026-08-18 | 16 | 0 | 5 | 0 | 🟠重要 |
| joomla (6) | 6.1.3 | 2026-08-18 | 34 | 6 | 7 | 0 | ⚠️要確認 |
| laravel (12) | 12.67.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| laravel (13) | 13.26.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| traefik (2.11) | 2.11.55 | 2026-08-18 | 20 | 3 | 7 | 0 | ⚠️要確認 |
| virtualbox (7.2) | 7.2.16 | 2026-08-18 | 33 | 0 | 19 | 0 | 🟠重要 |
非主要製品 の更新: 2件（Firefox 140 / 153 系 — ブラウザ更新であり、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
※ KEV 新規収載 6 件のうち is_major_product=true は CVE-2026-65400 (Apple macOS, CVSS 7.1) の 1 件のみで、CVSS が 9.0 未満かつ ransomware=Unknown のため ★★★ の条件（KEV該当 or CVSS≥9.0 かつ is_remote or ransomware=Known）を満たしません。ただし KEV 収載済みである点は軽視できず、macOS 端末を運用している場合は ★★ 相当として扱い、Apple 公式アドバイザリで対象バージョンを確認することを推奨します。
🟠 ★★ 参考 CVE
展開して表示 (5件)
（参考: 更新ソフト側の top_cves として CVE-2025-68121 / CVE-2026-39858 / CVE-2026-35051 / CVE-2026-54763 などの CVSS 10.0 クラスが Go・Traefik に紐づいて報告されています。これらは KEV 未収載かつ個別の attack_vector 情報が本ダイジェストに含まれないため上記ランク付けの対象外としましたが、実務上は Go / Traefik の更新適用時に公式リリースノートで対象 CVE を確認することを推奨します。）
📝 AI 全体サマリ
展開して読む
eol_date が 2026-02-01 と既に EOL を過ぎている表記であり、パッチが出ている今のうちに 3.x 系への移行計画を検討すべき可能性がある。(2) Joomla 6.1.3 は Critical 6 件と今週最多だが、自社で CMS として Joomla を運用しているかは要確認。(3) KEV 収載かつ主要製品該当は macOS の 1 件のみで、業務端末側の OS 更新状況を確認したい。(4) 今週は KEV 収載の中に ransomware=Known のものは無い。
# docker-compose.yml — Traefik 2.11 系の挙動確認用の最小構成（骨子）
services:
traefik:
image: traefik:2.11.55 # 更新前後で 2.11.54 等と入れ替えて差分を見る
command:
- --api.dashboard=true
- --api.insecure=true # 検証環境のみ。本番では絶対に有効化しない
- --providers.docker=true
- --entrypoints.web.address=:80
- --log.level=DEBUG
ports: ["8080:8080", "80:80"]
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
backend:
image: traefik/whoami # ルーティング先の確認用ダミー
labels:
- traefik.http.routers.who.rule=Host(`whoami.localhost`)
検証の観点は「ダッシュボード/API エンドポイントへの到達性」「ルーティングルールのヘッダ処理」「ミドルウェア設定の妥当性」の 3 点に絞り、具体的な攻撃手順は公式アドバイザリと Traefik のセキュリティリリースノートを一次情報として確認するのが確実。ネットワークは検証セグメントに閉じ、--api.insecure は検証後に必ず無効化すること。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-15",
"to": "2026-08-21",
"days": 7
},
"summary": {
"total_kev_new": 6,
"total_software_update": 15,
"by_date": {
"2026-08-20": {
"kev_new": 1,
"software_update": 7
},
"2026-08-19": {
"kev_new": 4,
"software_update": 8
},
"2026-08-18": {
"kev_new": 1,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-08-20",
"key": "CVE-2026-64849",
"cve_id": "CVE-2026-64849",
"vendor_project": "MLflow",
"product": "MLflow",
"vulnerability_name": "MLflow Server-Side Request Forgery Vulnerability",
"date_added": "2026-08-19",
"short_description": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-02",
"known_ransomware": "Unknown",
"cvss_score": 9.3,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and",
"epss_score": 0.01109
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-33824",
"cve_id": "CVE-2026-33824",
"vendor_project": "Microsoft",
"product": "Internet Key Exchange (IKE) Service Extensions",
"vulnerability_name": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.5585
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-55040",
"cve_id": "CVE-2026-55040",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Weak Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.1,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.",
"epss_score": 0.03971
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-59310",
"cve_id": "CVE-2026-59310",
"vendor_project": "Broadcom",
"product": "VMware vCenter",
"vulnerability_name": "Broadcom VMware vCenter Path Traversal Vulnerability",
"date_added": "2026-08-18",
"short_description": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.",
"epss_score": 0.0114
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-65400",
"cve_id": "CVE-2026-65400",
"vendor_project": "Apple",
"product": "macOS",
"vulnerability_name": "Apple macOS Improper Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 7.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "macos",
"title_en": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.",
"epss_score": 0.00496
},
{
"digest_date": "2026-08-18",
"key": "CVE-2025-62593",
"cve_id": "CVE-2025-62593",
"vendor_project": "Ray-Project",
"product": "Ray",
"vulnerability_name": "Ray-Project Ray Code Injection Vulnerability",
"date_added": "2026-08-17",
"short_description": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-20",
"known_ransomware": "Unknown",
"cvss_score": 9.4,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string \"Mozilla\" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DN",
"epss_score": 0.00369
}
],
"software_update": [
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:17",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.1+1",
"release_date": "2021-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2027-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:21",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.1+1",
"release_date": "2023-10-10",
"latest_release_date": "2026-08-19",
"eol_date": "2029-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:25",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.1+1",
"release_date": "2025-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2031-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.25",
"product": "go",
"category": "programming",
"cycle": "1.25",
"latest": "1.25.14",
"release_date": "2025-08-12",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.26",
"product": "go",
"category": "programming",
"cycle": "1.26",
"latest": "1.26.7",
"release_date": "2026-02-10",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "microsoft-build-of-openjdk:11",
"product": "microsoft-build-of-openjdk",
"category": "programming",
"cycle": "11",
"latest": "11.0.32.1",
"release_date": "2019-01-21",
"latest_release_date": "2026-08-19",
"eol_date": "2027-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "nginx:1.31",
"product": "nginx",
"category": "webserver",
"cycle": "1.31",
"latest": "1.31.4",
"release_date": "2026-05-13",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:140",
"product": "firefox",
"category": "browser",
"cycle": "140",
"latest": "140.14.0",
"release_date": "2025-06-24",
"latest_release_date": "2026-08-18",
"eol_date": "2026-09-29",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.1.0",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.578",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "joomla:6",
"product": "joomla",
"category": "cms",
"cycle": "6",
"latest": "6.1.3",
"release_date": "2025-10-14",
"latest_release_date": "2026-08-18",
"eol_date": "2029-10-16",
"support_date": "2028-10-17",
"is_major_product": true,
"cve_stats": {
"total": 34,
"critical": 6,
"high": 7,
"medium": 21,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40383",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48898",
"severity": "CRITICAL",
"score": 9.8
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.67.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-18",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.26.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-18",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "traefik:2.11",
"product": "traefik",
"category": "webserver",
"cycle": "2.11",
"latest": "2.11.55",
"release_date": "2024-02-12",
"latest_release_date": "2026-08-18",
"eol_date": "2026-02-01",
"support_date": "2025-04-29",
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 3,
"high": 7,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-39858",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-35051",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-54763",
"severity": "CRITICAL",
"score": 10.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "virtualbox:7.2",
"product": "virtualbox",
"category": "virtualization",
"cycle": "7.2",
"latest": "7.2.16",
"release_date": "2025-08-14",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 33,
"critical": 0,
"high": 19,
"medium": 8,
"low": 6,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21955",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21988",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21987",
"severity": "HIGH",
"score": 8.2
}
]
}
}
]
}