📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 9
|
更新ソフト 21
|
対象期間 7日
|
生成 2026-08-24 11:01:01
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| nextjs | 16.3.2 | 2026-08-21 | 31 | 1 | 12 | 1 | ⚠️要確認 |
| elasticsearch | 9.5.2 | 2026-08-20 | 6 | 0 | 0 | 0 | ✅計画 |
| laravel (11) | 11.56.0 | 2026-08-20 | 0 | 0 | 0 | 0 | ✅計画 |
| spring-boot (4.0) | 4.0.8 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-boot (4.1) | 4.1.1 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-framework (7.0) | 7.0.9 | 2026-08-20 | 9 | 0 | 3 | 0 | 🟠重要 |
| eclipse-temurin (17) | 17.0.20.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (21) | 21.0.12.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (25) | 25.0.4.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| go (1.25) | 1.25.14 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| go (1.26) | 1.26.7 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| microsoft-build-of-openjdk (11) | 11.0.32.1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| nginx | 1.31.4 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| jenkins | 2.578 | 2026-08-18 | 16 | 0 | 5 | 0 | 🟠重要 |
| joomla | 6.1.3 | 2026-08-18 | 34 | 6 | 7 | 0 | ⚠️要確認 |
| laravel (12) | 12.67.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| laravel (13) | 13.26.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| traefik (2.11) | 2.11.55 | 2026-08-18 | 20 | 3 | 7 | 0 | ⚠️要確認 |
| virtualbox | 7.2.16 | 2026-08-18 | 33 | 0 | 19 | 0 | 🟠重要 |
| macos (KEV: CVE-2026-65400) | — | 2026-08-19 | 1 | 0 | 1 | 1 | ⚠️要確認 |
非主要製品 の更新: 2件（firefox 140.14.0 / 153.1.0 — ブラウザ系、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（is_major_product=true の CVE は macOS の CVE-2026-65400 のみで、KEV 該当ではあるものの CVSS 7.1 / ransomware=Unknown のため、方針上の ★★★ 条件「CVSS>=9.0 かつ is_remote=true」「ransomware=Known」を満たさない可能性が高いです。ただし KEV 掲載済みで実際に悪用が確認されている可能性があるため、下記 ★★ で扱いつつ macOS 端末の Screen Sharing 設定は早めに確認することを推奨します。）
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| — | — | — | — | — | 該当なし |
🟠 ★★ 参考 CVE
展開して表示 (7件)
（参考: CVE-2026-72530 TrueConf Server CVSS 9.0 / CVE-2026-73570 Zimbra CVSS 8.9 は KEV 掲載だが、方針上の ★★ 閾値（非主要製品は KEV 該当）にはいずれも当てはまるため、上記と同様に自社影響は低い扱いとしています。）
📝 AI 全体サマリ
展開して読む
- Next.js 16.3.2 は主要製品かつ cve_stats に KEV=1（top_cves に CVE-2025-55182 / CVSS 10.0）が含まれるため、本ダイジェストの kev_new 一覧には出ていなくても自社影響の観点では最優先で確認したい対象です。実際に該当バージョン系列が影響を受けるかは公式リリースノートと GitHub Security Advisory で確認してください。
- Traefik 2.11 は eol_date が 2026-02-01 で既に EOL を過ぎており、Critical 3 件を抱えたまま延命される形になります。利用箇所があれば v3 系への移行検討が必要な可能性があります。Laravel 11（eol 2026-03-12）と Spring Boot 4.0（eol 2026-12-31）も同様に EOL 期限を意識した計画が望まれます。
- CVE-2026-33824（Microsoft IKE）は EPSS 0.5585 と突出しており、KEV 一覧の中で最も短期に悪用が拡大する可能性があります。自社の運用対象外ではありますが、業務 Windows 端末・VPN 関連コンポーネントへの月例パッチ適用状況の確認は有効と考えられます。
- Go の Critical 3 件（CVE-2025-68121 CVSS 10.0 ほか）は、自社で Go 製ツールをビルドしている場合、依存ライブラリ側の脆弱性である可能性もあります。govulncheck によるリポジトリ横断スキャンで実際に到達可能かを切り分けるのが現実的です。
- 優先度が高いのは Next.js の CVE-2025-55182（CVSS 10.0, KEV 該当の可能性） です。自社アプリのフレームワークに直結するため、隔離環境で「脆弱バージョン → 修正版」の挙動差を確認する価値があります。exploit コードは記載しませんが、骨子は以下のとおりです。
# docker-compose.yml（検証骨子。ネットワークは外部非公開に隔離する）
services:
next-vuln:
image: node:22-bookworm
working_dir: /app
# 影響を受けるとされる系列を pin して起動（バージョンは公式アドバイザリで確認）
command: sh -c "npx --yes create-next-app@<vulnerable> demo --ts --no-git && cd demo && npm run dev -- -H 0.0.0.0"
ports: ["127.0.0.1:3000:3000"]
next-fixed:
image: node:22-bookworm
working_dir: /app
command: sh -c "npx --yes create-next-app@16.3.2 demo --ts --no-git && cd demo && npm run dev -- -H 0.0.0.0"
ports: ["127.0.0.1:3001:3000"]
networks:
default:
internal: true # 外部到達を遮断
- 検証観点は「アドバイザリ記載の前提条件（ミドルウェア構成 / SSR 有無 / キャッシュ設定など）が自社アプリに存在するか」の確認に留め、実際の攻撃再現は公式が公開している再現手順の範囲内で行うことを推奨します。
- 併せて、既存の 脆弱性検証環境の構築 プロジェクト配下に検証ディレクトリを切って記録を残すと、次回以降の同系列 CVE の切り分けが速くなる可能性があります。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-18",
"to": "2026-08-24",
"days": 7
},
"summary": {
"total_kev_new": 9,
"total_software_update": 21,
"by_date": {
"2026-08-22": {
"kev_new": 1,
"software_update": 1
},
"2026-08-21": {
"kev_new": 2,
"software_update": 5
},
"2026-08-20": {
"kev_new": 1,
"software_update": 7
},
"2026-08-19": {
"kev_new": 4,
"software_update": 8
},
"2026-08-18": {
"kev_new": 1,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-08-22",
"key": "CVE-2026-73570",
"cve_id": "CVE-2026-73570",
"vendor_project": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)",
"vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability",
"date_added": "2026-08-21",
"short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-24",
"known_ransomware": "Unknown",
"cvss_score": 8.9,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"epss_score": 0.00539
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72529",
"cve_id": "CVE-2026-72529",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Missing Authentication for Critical Function Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-23",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.",
"epss_score": 0.00284
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72530",
"cve_id": "CVE-2026-72530",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Code Injection Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-03",
"known_ransomware": "Unknown",
"cvss_score": 9.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"epss_score": 0.0034
},
{
"digest_date": "2026-08-20",
"key": "CVE-2026-64849",
"cve_id": "CVE-2026-64849",
"vendor_project": "MLflow",
"product": "MLflow",
"vulnerability_name": "MLflow Server-Side Request Forgery Vulnerability",
"date_added": "2026-08-19",
"short_description": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-02",
"known_ransomware": "Unknown",
"cvss_score": 9.3,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and",
"epss_score": 0.01109
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-33824",
"cve_id": "CVE-2026-33824",
"vendor_project": "Microsoft",
"product": "Internet Key Exchange (IKE) Service Extensions",
"vulnerability_name": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.5585
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-55040",
"cve_id": "CVE-2026-55040",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Weak Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.1,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.",
"epss_score": 0.03971
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-59310",
"cve_id": "CVE-2026-59310",
"vendor_project": "Broadcom",
"product": "VMware vCenter",
"vulnerability_name": "Broadcom VMware vCenter Path Traversal Vulnerability",
"date_added": "2026-08-18",
"short_description": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.",
"epss_score": 0.0114
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-65400",
"cve_id": "CVE-2026-65400",
"vendor_project": "Apple",
"product": "macOS",
"vulnerability_name": "Apple macOS Improper Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 7.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "macos",
"title_en": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.",
"epss_score": 0.00496
},
{
"digest_date": "2026-08-18",
"key": "CVE-2025-62593",
"cve_id": "CVE-2025-62593",
"vendor_project": "Ray-Project",
"product": "Ray",
"vulnerability_name": "Ray-Project Ray Code Injection Vulnerability",
"date_added": "2026-08-17",
"short_description": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-20",
"known_ransomware": "Unknown",
"cvss_score": 9.4,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string \"Mozilla\" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DN",
"epss_score": 0.00369
}
],
"software_update": [
{
"digest_date": "2026-08-22",
"key": "nextjs:16",
"product": "nextjs",
"category": "framework",
"cycle": "16",
"latest": "16.3.2",
"release_date": "2025-10-22",
"latest_release_date": "2026-08-21",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 31,
"critical": 1,
"high": 12,
"medium": 17,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-55182",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-44578",
"severity": "HIGH",
"score": 8.6
},
{
"cve_id": "CVE-2026-64642",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "elasticsearch:9.5",
"product": "elasticsearch",
"category": "database",
"cycle": "9.5",
"latest": "9.5.2",
"release_date": "2026-08-04",
"latest_release_date": "2026-08-20",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 0,
"medium": 6,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-37731",
"severity": "MEDIUM",
"score": 6.8
},
{
"cve_id": "CVE-2026-49090",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2025-68384",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "laravel:11",
"product": "laravel",
"category": "framework",
"cycle": "11",
"latest": "11.56.0",
"release_date": "2024-03-12",
"latest_release_date": "2026-08-20",
"eol_date": "2026-03-12",
"support_date": "2025-09-03",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.0",
"product": "spring-boot",
"category": "framework",
"cycle": "4.0",
"latest": "4.0.8",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.1",
"product": "spring-boot",
"category": "framework",
"cycle": "4.1",
"latest": "4.1.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-framework:7.0",
"product": "spring-framework",
"category": "framework",
"cycle": "7.0",
"latest": "7.0.9",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 9,
"critical": 0,
"high": 3,
"medium": 5,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-41849",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41842",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41850",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:17",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.1+1",
"release_date": "2021-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2027-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:21",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.1+1",
"release_date": "2023-10-10",
"latest_release_date": "2026-08-19",
"eol_date": "2029-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:25",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.1+1",
"release_date": "2025-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2031-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.25",
"product": "go",
"category": "programming",
"cycle": "1.25",
"latest": "1.25.14",
"release_date": "2025-08-12",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.26",
"product": "go",
"category": "programming",
"cycle": "1.26",
"latest": "1.26.7",
"release_date": "2026-02-10",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "microsoft-build-of-openjdk:11",
"product": "microsoft-build-of-openjdk",
"category": "programming",
"cycle": "11",
"latest": "11.0.32.1",
"release_date": "2019-01-21",
"latest_release_date": "2026-08-19",
"eol_date": "2027-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "nginx:1.31",
"product": "nginx",
"category": "webserver",
"cycle": "1.31",
"latest": "1.31.4",
"release_date": "2026-05-13",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:140",
"product": "firefox",
"category": "browser",
"cycle": "140",
"latest": "140.14.0",
"release_date": "2025-06-24",
"latest_release_date": "2026-08-18",
"eol_date": "2026-09-29",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.1.0",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.578",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "joomla:6",
"product": "joomla",
"category": "cms",
"cycle": "6",
"latest": "6.1.3",
"release_date": "2025-10-14",
"latest_release_date": "2026-08-18",
"eol_date": "2029-10-16",
"support_date": "2028-10-17",
"is_major_product": true,
"cve_stats": {
"total": 34,
"critical": 6,
"high": 7,
"medium": 21,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40383",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48898",
"severity": "CRITICAL",
"score": 9.8
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.67.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-18",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.26.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-18",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "traefik:2.11",
"product": "traefik",
"category": "webserver",
"cycle": "2.11",
"latest": "2.11.55",
"release_date": "2024-02-12",
"latest_release_date": "2026-08-18",
"eol_date": "2026-02-01",
"support_date": "2025-04-29",
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 3,
"high": 7,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-39858",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-35051",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-54763",
"severity": "CRITICAL",
"score": 10.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "virtualbox:7.2",
"product": "virtualbox",
"category": "virtualization",
"cycle": "7.2",
"latest": "7.2.16",
"release_date": "2025-08-14",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 33,
"critical": 0,
"high": 19,
"medium": 8,
"low": 6,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21955",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21988",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21987",
"severity": "HIGH",
"score": 8.2
}
]
}
}
]
}