📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 8
|
更新ソフト 21
|
対象期間 7日
|
生成 2026-08-25 11:00:56
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| nextjs | 16.3.2 | 2026-08-21 | 31 | 1 | 12 | 1 | ⚠️要確認 |
| elasticsearch | 9.5.2 | 2026-08-20 | 6 | 0 | 0 | 0 | ✅計画 |
| laravel (11) | 11.56.0 | 2026-08-20 | 0 | 0 | 0 | 0 | ✅計画 |
| spring-boot (4.0) | 4.0.8 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-boot (4.1) | 4.1.1 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-framework | 7.0.9 | 2026-08-20 | 9 | 0 | 3 | 0 | 🟠重要 |
| eclipse-temurin (17) | 17.0.20.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (21) | 21.0.12.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (25) | 25.0.4.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| go (1.25) | 1.25.14 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| go (1.26) | 1.26.7 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| microsoft-build-of-openjdk | 11.0.32.1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| nginx | 1.31.4 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| jenkins | 2.578 | 2026-08-18 | 16 | 0 | 5 | 0 | 🟠重要 |
| joomla | 6.1.3 | 2026-08-18 | 34 | 6 | 7 | 0 | ⚠️要確認 |
| laravel (12) | 12.67.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| laravel (13) | 13.26.0 | 2026-08-18 | 0 | 0 | 0 | 0 | ✅計画 |
| traefik | 2.11.55 | 2026-08-18 | 20 | 3 | 7 | 0 | ⚠️要確認 |
| virtualbox | 7.2.16 | 2026-08-18 | 33 | 0 | 19 | 0 | 🟠重要 |
非主要製品 の更新: 2件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（KEV 新規追加 8 件のうち is_major_product=true は CVE-2026-65400 (macOS) のみですが、CVSS 7.1 のため ★★★ の条件を満たしません。★★ に分類しています。）
🟠 ★★ 参考 CVE
展開して表示 (7件)
（CVE-2026-73570 / Zimbra ZCS は CVSS 8.9・非主要製品のため ★ その他に分類しています。KEV 掲載ではあるので、社内にメール基盤として存在しないかの確認のみ推奨。）
📝 AI 全体サマリ
展開して読む
- Laravel 11 (11.56.0) は eol_date=2026-03-12 で既に EOL を超過しています。更新が出ていても長期のセキュリティ修正は期待しにくいため、12 系または 13 系への移行計画を優先度高で検討する価値があります。
- Traefik 2.11 も eol_date=2026-02-01 で EOL 超過、かつ CVSS 10.0 の Critical を 3 件抱えています。自社でリバースプロキシとして利用している場合、3.x 系への移行が最優先候補になる可能性があります。
- Spring Boot 4.0 は eol_date=2026-12-31 で年内に EOL、4.1 系（2027-07-31）への追随を計画に入れておくと安全です。
- Next.js は cve_stats に kev=1 が立っており、CVE-2025-55182 (CVSS 10.0) が該当する可能性があります。自社で Next.js を運用している場合、実効的には今週最も確認優先度が高い項目と考えられます。★★★ の判定条件（KEV フラグは CVE 単位）には乗っていませんが、運用判断としては早期のバージョン追随を推奨します。
- EPSS の観点では CVE-2026-33824 (0.56) が突出しています。他はいずれも 0.02 未満で、直近の大量悪用が観測されている状況ではないと見られます。
```yaml
# docker-compose.yml（骨子）
services:
nextjs-vuln:
image: node:22-alpine
working_dir: /app
command: sh -c "npx create-next-app@<脆弱バージョン> . --yes && npm run dev"
ports: ["3000:3000"]
networks: [isolated]
nextjs-fixed:
image: node:22-alpine
working_dir: /app
command: sh -c "npx create-next-app@16.3.2 . --yes && npm run dev"
ports: ["3001:3000"]
networks: [isolated]
proxy-log: # リクエスト/レスポンス差分の観測用
image: mitmproxy/mitmproxy
networks: [isolated]
networks:
isolated:
internal: true # 外部到達を遮断した閉域で検証
```
検証時は internal: true の閉域ネットワークに限定し、対象バージョンと修正コミットは Next.js の公式セキュリティアドバイザリ（GitHub Security Advisories）で確認したうえで実施してください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-19",
"to": "2026-08-25",
"days": 7
},
"summary": {
"total_kev_new": 8,
"total_software_update": 21,
"by_date": {
"2026-08-22": {
"kev_new": 1,
"software_update": 1
},
"2026-08-21": {
"kev_new": 2,
"software_update": 5
},
"2026-08-20": {
"kev_new": 1,
"software_update": 7
},
"2026-08-19": {
"kev_new": 4,
"software_update": 8
}
}
},
"kev_new": [
{
"digest_date": "2026-08-22",
"key": "CVE-2026-73570",
"cve_id": "CVE-2026-73570",
"vendor_project": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)",
"vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability",
"date_added": "2026-08-21",
"short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-24",
"known_ransomware": "Unknown",
"cvss_score": 8.9,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"epss_score": 0.00539
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72529",
"cve_id": "CVE-2026-72529",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Missing Authentication for Critical Function Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-23",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.",
"epss_score": 0.00284
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72530",
"cve_id": "CVE-2026-72530",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Code Injection Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-03",
"known_ransomware": "Unknown",
"cvss_score": 9.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"epss_score": 0.0034
},
{
"digest_date": "2026-08-20",
"key": "CVE-2026-64849",
"cve_id": "CVE-2026-64849",
"vendor_project": "MLflow",
"product": "MLflow",
"vulnerability_name": "MLflow Server-Side Request Forgery Vulnerability",
"date_added": "2026-08-19",
"short_description": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-02",
"known_ransomware": "Unknown",
"cvss_score": 9.3,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and",
"epss_score": 0.01109
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-33824",
"cve_id": "CVE-2026-33824",
"vendor_project": "Microsoft",
"product": "Internet Key Exchange (IKE) Service Extensions",
"vulnerability_name": "Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.",
"epss_score": 0.5585
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-55040",
"cve_id": "CVE-2026-55040",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Weak Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.1,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.",
"epss_score": 0.03971
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-59310",
"cve_id": "CVE-2026-59310",
"vendor_project": "Broadcom",
"product": "VMware vCenter",
"vulnerability_name": "Broadcom VMware vCenter Path Traversal Vulnerability",
"date_added": "2026-08-18",
"short_description": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.",
"epss_score": 0.0114
},
{
"digest_date": "2026-08-19",
"key": "CVE-2026-65400",
"cve_id": "CVE-2026-65400",
"vendor_project": "Apple",
"product": "macOS",
"vulnerability_name": "Apple macOS Improper Authentication Vulnerability",
"date_added": "2026-08-18",
"short_description": "Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-21",
"known_ransomware": "Unknown",
"cvss_score": 7.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "macos",
"title_en": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.",
"epss_score": 0.00496
}
],
"software_update": [
{
"digest_date": "2026-08-22",
"key": "nextjs:16",
"product": "nextjs",
"category": "framework",
"cycle": "16",
"latest": "16.3.2",
"release_date": "2025-10-22",
"latest_release_date": "2026-08-21",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 31,
"critical": 1,
"high": 12,
"medium": 17,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-55182",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-44578",
"severity": "HIGH",
"score": 8.6
},
{
"cve_id": "CVE-2026-64642",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "elasticsearch:9.5",
"product": "elasticsearch",
"category": "database",
"cycle": "9.5",
"latest": "9.5.2",
"release_date": "2026-08-04",
"latest_release_date": "2026-08-20",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 0,
"medium": 6,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-37731",
"severity": "MEDIUM",
"score": 6.8
},
{
"cve_id": "CVE-2026-49090",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2025-68384",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "laravel:11",
"product": "laravel",
"category": "framework",
"cycle": "11",
"latest": "11.56.0",
"release_date": "2024-03-12",
"latest_release_date": "2026-08-20",
"eol_date": "2026-03-12",
"support_date": "2025-09-03",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.0",
"product": "spring-boot",
"category": "framework",
"cycle": "4.0",
"latest": "4.0.8",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.1",
"product": "spring-boot",
"category": "framework",
"cycle": "4.1",
"latest": "4.1.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-framework:7.0",
"product": "spring-framework",
"category": "framework",
"cycle": "7.0",
"latest": "7.0.9",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 9,
"critical": 0,
"high": 3,
"medium": 5,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-41849",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41842",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41850",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:17",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.1+1",
"release_date": "2021-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2027-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:21",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.1+1",
"release_date": "2023-10-10",
"latest_release_date": "2026-08-19",
"eol_date": "2029-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:25",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.1+1",
"release_date": "2025-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2031-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.25",
"product": "go",
"category": "programming",
"cycle": "1.25",
"latest": "1.25.14",
"release_date": "2025-08-12",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.26",
"product": "go",
"category": "programming",
"cycle": "1.26",
"latest": "1.26.7",
"release_date": "2026-02-10",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "microsoft-build-of-openjdk:11",
"product": "microsoft-build-of-openjdk",
"category": "programming",
"cycle": "11",
"latest": "11.0.32.1",
"release_date": "2019-01-21",
"latest_release_date": "2026-08-19",
"eol_date": "2027-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "nginx:1.31",
"product": "nginx",
"category": "webserver",
"cycle": "1.31",
"latest": "1.31.4",
"release_date": "2026-05-13",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:140",
"product": "firefox",
"category": "browser",
"cycle": "140",
"latest": "140.14.0",
"release_date": "2025-06-24",
"latest_release_date": "2026-08-18",
"eol_date": "2026-09-29",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "firefox:153",
"product": "firefox",
"category": "browser",
"cycle": "153",
"latest": "153.1.0",
"release_date": "2026-07-21",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.578",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "joomla:6",
"product": "joomla",
"category": "cms",
"cycle": "6",
"latest": "6.1.3",
"release_date": "2025-10-14",
"latest_release_date": "2026-08-18",
"eol_date": "2029-10-16",
"support_date": "2028-10-17",
"is_major_product": true,
"cve_stats": {
"total": 34,
"critical": 6,
"high": 7,
"medium": 21,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40383",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-48898",
"severity": "CRITICAL",
"score": 9.8
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:12",
"product": "laravel",
"category": "framework",
"cycle": "12",
"latest": "12.67.0",
"release_date": "2025-02-24",
"latest_release_date": "2026-08-18",
"eol_date": "2027-02-24",
"support_date": "2026-08-16",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.26.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-08-18",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-19",
"key": "traefik:2.11",
"product": "traefik",
"category": "webserver",
"cycle": "2.11",
"latest": "2.11.55",
"release_date": "2024-02-12",
"latest_release_date": "2026-08-18",
"eol_date": "2026-02-01",
"support_date": "2025-04-29",
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 3,
"high": 7,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-39858",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-35051",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-54763",
"severity": "CRITICAL",
"score": 10.0
}
]
}
},
{
"digest_date": "2026-08-19",
"key": "virtualbox:7.2",
"product": "virtualbox",
"category": "virtualization",
"cycle": "7.2",
"latest": "7.2.16",
"release_date": "2025-08-14",
"latest_release_date": "2026-08-18",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 33,
"critical": 0,
"high": 19,
"medium": 8,
"low": 6,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-21955",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21988",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-21987",
"severity": "HIGH",
"score": 8.2
}
]
}
}
]
}