📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 9
|
更新ソフト 21
|
対象期間 7日
|
生成 2026-08-24 09:20:20
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| nextjs | 16.3.2 | 2026-08-21 | 31 | 1 | 12 | 1 | ⚠️要確認 |
| elasticsearch | 9.5.2 | 2026-08-20 | 6 | 0 | 0 | 0 | ✅計画 |
| laravel (11) | 11.56.0 | 2026-08-20 | 0 | 0 | 0 | 0 | ✅計画 |
| spring-boot (4.0) | 4.0.8 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-boot (4.1) | 4.1.1 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-framework (7.0) | 7.0.9 | 2026-08-20 | 9 | 0 | 3 | 0 | 🟠重要 |
| eclipse-temurin (17) | 17.0.20.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (21) | 21.0.12.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (25) | 25.0.4.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| go (1.25) | 1.25.14 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| go (1.26) | 1.26.7 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| microsoft-build-of-openjdk (11) | 11.0.32.1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| nginx | 1.31.4 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| jenkins | 2.578 | 2026-08-18 | 16 | 0 | 5 | 0 | 🟠重要 |
| joomla | 6.1.3 | 2026-08-18 | 34 | 6 | 7 | 0 | ⚠️要確認 |
| laravel (12) | 12.67.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| laravel (13) | 13.26.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| traefik (2.11) | 2.11.55 | 2026-08-18 | 20 | 3 | 7 | 0 | ⚠️要確認 |
| virtualbox | 7.2.16 | 2026-08-18 | 33 | 0 | 19 | 0 | 🟠重要 |
非主要製品 の更新: 2件（Firefox 140/153 系。OS ディストリ / Alpine 派生などと同様、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（★★★ の条件は「is_major_product=true」かつ「KEV該当 / CVSS>=9.0 かつ is_remote=true / ransomware=Known」ですが、KEV 新規掲載 9 件のうち is_major_product=true は CVE-2026-65400 (macOS, CVSS 7.1) の1件のみで、これは下位ランクに該当する可能性があります。なお nextjs 16.3.2 の cve_stats には kev=1 が含まれており、CVE-2025-55182 (CVSS 10.0) が該当する可能性があるため、公式アドバイザリで KEV 掲載状況と自社利用バージョンの影響有無を確認することを推奨します。）
🟠 ★★ 参考 CVE
展開して表示 (6件)
（参考: CVE-2026-73570 Zimbra (CVSS 8.9, KEV)、CVE-2025-62593 Ray (CVSS 9.4, KEV)、CVE-2026-65400 macOS (CVSS 7.1, KEV) は上記条件の閾値未満、または非リモート/スコア条件に届かないため ★ に分類。ただし Ray は CVSS 9.4 の KEV 該当であり、AI/ML ワークロードで Ray を使う場合は個別に確認する価値がある可能性がある。）
📝 AI 全体サマリ
展開して読む
```yaml
# 検証環境骨子（実際の攻撃コードは含まない／隔離ネットワークで実施）
services:
app-under-test:
# 影響有無を切り分けるため「脆弱版」「修正版」を別サービスで並走させる
image: node:22-bookworm
working_dir: /app
command: sh -c "npx create-next-app@16.3.1 . --yes && npm run build && npm start"
networks: [lab]
app-patched:
image: node:22-bookworm
working_dir: /app
command: sh -c "npx create-next-app@16.3.2 . --yes && npm run build && npm start"
networks: [lab]
observer:
# レスポンス差分・ログ差分の観測用（curl / mitmproxy 等）
image: mitmproxy/mitmproxy
networks: [lab]
networks:
lab:
internal: true # 外部へ出さない。メタデータ到達性検証時も同様に隔離必須
```
検証手順の骨子: ①公式アドバイザリで影響バージョン範囲と前提条件（該当機能の有効化状況等）を確認 → ②脆弱版／修正版で同一リクエストを送り挙動差分のみを観測 → ③自社構成が前提条件に合致するかを判定。MLflow 側を検証する場合は、クラウドメタデータエンドポイントを模した内部スタブを lab ネットワーク内に立て、実クラウド環境の認証情報には一切触れない構成とする。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-18",
"to": "2026-08-24",
"days": 7
},
"summary": {
"total_kev_new": 9,
"total_software_update": 21,
"by_date": {
"2026-08-22": {
"kev_new": 1,
"software_update": 1
},
"2026-08-21": {
"kev_new": 2,
"software_update": 5
},
"2026-08-20": {
"kev_new": 1,
"software_update": 7
},
"2026-08-19": {
"kev_new": 4,
"software_update": 8
},
"2026-08-18": {
"kev_new": 1,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-08-22",
"key": "CVE-2026-73570",
"cve_id": "CVE-2026-73570",
"vendor_project": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)",
"vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability",
"date_added": "2026-08-21",
"short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-24",
"known_ransomware": "Unknown",
"cvss_score": 8.9,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"epss_score": 0.00539
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72529",
"cve_id": "CVE-2026-72529",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Missing Authentication for Critical Function Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-23",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.",
"epss_score": 0.00284
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72530",
"cve_id": "CVE-2026-72530",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Code Injection Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-03",
"known_ransomware": "Unknown",
"cvss_score": 9.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"epss_score": 0.0034
},
{
"digest_date": "2026-08-20",
"key": "CVE-2026-64849",
"cve_id": "CVE-2026-64849",
"vendor_project": "MLflow",
"product": "MLflow",
"vulnerability_name": "MLflow Server-Side Request Forgery Vulnerability",
"date_added": "2026-08-19",
"short_description": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-02",
"known_ransomware": "Unknown",
"cvss_score": 9.3,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and",
"epss_score": 0.01109
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-33824",
"cve_id": "CVE-2026-33824",
"vendor_project": "Microsoft",
"product": "Internet Key Exchange (IKE) Service Extensions",
"vulnerability_name": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.5585
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-55040",
"cve_id": "CVE-2026-55040",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Weak Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.1,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.",
"epss_score": 0.03971
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-59310",
"cve_id": "CVE-2026-59310",
"vendor_project": "Broadcom",
"product": "VMware vCenter",
"vulnerability_name": "Broadcom VMware vCenter Path Traversal Vulnerability",
"date_added": "2026-08-18",
"short_description": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.",
"epss_score": 0.0114
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-65400",
"cve_id": "CVE-2026-65400",
"vendor_project": "Apple",
"product": "macOS",
"vulnerability_name": "Apple macOS Improper Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 7.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "macos",
"title_en": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.",
"epss_score": 0.00496
},
{
"digest_date": "2026-08-18",
"key": "CVE-2025-62593",
"cve_id": "CVE-2025-62593",
"vendor_project": "Ray-Project",
"product": "Ray",
"vulnerability_name": "Ray-Project Ray Code Injection Vulnerability",
"date_added": "2026-08-17",
"short_description": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-20",
"known_ransomware": "Unknown",
"cvss_score": 9.4,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string \"Mozilla\" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DN",
"epss_score": 0.00369
}
],
"software_update": [
{
"digest_date": "2026-08-22",
"key": "nextjs:16",
"product": "nextjs",
"category": "framework",
"cycle": "16",
"latest": "16.3.2",
"release_date": "2025-10-22",
"latest_release_date": "2026-08-21",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 31,
"critical": 1,
"high": 12,
"medium": 17,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-55182",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-44578",
"severity": "HIGH",
"score": 8.6
},
{
"cve_id": "CVE-2026-64642",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "elasticsearch:9.5",
"product": "elasticsearch",
"category": "database",
"cycle": "9.5",
"latest": "9.5.2",
"release_date": "2026-08-04",
"latest_release_date": "2026-08-20",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 0,
"medium": 6,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-37731",
"severity": "MEDIUM",
"score": 6.8
},
{
"cve_id": "CVE-2026-49090",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2025-68384",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "laravel:11",
"product": "laravel",
"category": "framework",
"cycle": "11",
"latest": "11.56.0",
"release_date": "2024-03-12",
"latest_release_date": "2026-08-20",
"eol_date": "2026-03-12",
"support_date": "2025-09-03",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.0",
"product": "spring-boot",
"category": "framework",
"cycle": "4.0",
"latest": "4.0.8",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.1",
"product": "spring-boot",
"category": "framework",
"cycle": "4.1",
"latest": "4.1.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-framework:7.0",
"product": "spring-framework",
"category": "framework",
"cycle": "7.0",
"latest": "7.0.9",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 9,
"critical": 0,
"high": 3,
"medium": 5,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-41849",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41842",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41850",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:17",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.1+1",
"release_date": "2021-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2027-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:21",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.1+1",
"release_date": "2023-10-10",
"latest_release_date": "2026-08-19",
"eol_date": "2029-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:25",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.1+1",
"release_date": "2025-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2031-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.25",
"product": "go",
"category": "programming",
"cycle": "1.25",
"latest": "1.25.14",
"release_date": "2025-08-12",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.26",
"product": "go",
"category": "programming",
"cycle": "1.26",
"latest": "1.26.7",
"release_date": "2026-02-10",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "microsoft-build-of-openjdk:11",
"product": "microsoft-build-of-openjdk",
"category": "programming",
"cycle": "11",
"latest": "11.0.32.1",
"release_date": "2019-01-21",
"latest_release_date": "2026-08-19",
"eol_date": "2027-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "nginx:1.31",
"product": "nginx",
"category": "webserver",
"cycle": "1.31",
"latest": "1.31.4",
"release_date": "2026-05-13",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:140",
"product": "firefox",
"category": "browser",
"cycle": "140",
"latest": "140.14.0",
"release_date": "2025-06-24",
"latest_release_date": "2026-08-18",
"eol_date": "2026-09-29",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.1.0",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.578",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "joomla:6",
"product": "joomla",
"category": "cms",
"cycle": "6",
"latest": "6.1.3",
"release_date": "2025-10-14",
"latest_release_date": "2026-08-18",
"eol_date": "2029-10-16",
"support_date": "2028-10-17",
"is_major_product": true,
"cve_stats": {
"total": 34,
"critical": 6,
"high": 7,
"medium": 21,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40383",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48898",
"severity": "CRITICAL",
"score": 9.8
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.67.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-18",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.26.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-18",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "traefik:2.11",
"product": "traefik",
"category": "webserver",
"cycle": "2.11",
"latest": "2.11.55",
"release_date": "2024-02-12",
"latest_release_date": "2026-08-18",
"eol_date": "2026-02-01",
"support_date": "2025-04-29",
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 3,
"high": 7,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-39858",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-35051",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-54763",
"severity": "CRITICAL",
"score": 10.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "virtualbox:7.2",
"product": "virtualbox",
"category": "virtualization",
"cycle": "7.2",
"latest": "7.2.16",
"release_date": "2025-08-14",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 33,
"critical": 0,
"high": 19,
"medium": 8,
"low": 6,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21955",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21988",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21987",
"severity": "HIGH",
"score": 8.2
}
]
}
}
]
}