📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 13
|
対象期間 7日
|
生成 2026-08-26 11:00:54
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| nextjs (16) | 16.3.2 | 2026-08-21 | 31 | 1 | 12 | 1 | ⚠️要確認 |
| elasticsearch (9.5) | 9.5.2 | 2026-08-20 | 6 | 0 | 0 | 0 | ✅計画 |
| laravel (11) | 11.56.0 | 2026-08-20 | 0 | 0 | 0 | 0 | ✅計画 |
| spring-boot (4.0) | 4.0.8 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-boot (4.1) | 4.1.1 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-framework (7.0) | 7.0.9 | 2026-08-20 | 9 | 0 | 3 | 0 | 🟠重要 |
| eclipse-temurin (17) | 17.0.20.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (21) | 21.0.12.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| eclipse-temurin (25) | 25.0.4.1+1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| go (1.25) | 1.25.14 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| go (1.26) | 1.26.7 | 2026-08-19 | 26 | 3 | 13 | 0 | ⚠️要確認 |
| microsoft-build-of-openjdk (11) | 11.0.32.1 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
| nginx (1.31) | 1.31.4 | 2026-08-19 | 0 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（補足: 今回の KEV 新規登録 5 件はいずれも is_major_product=false のため ★★★ の条件を満たしていない可能性があります。ただし Next.js 16 系の CVE 統計に kev=1 が含まれており、これは主要製品側の KEV 該当を示唆する可能性があるため、後述の通り個別確認を推奨します。）
🟠 ★★ 参考 CVE
展開して表示 (4件)
（★★ の閾値外だが要注意）
📝 AI 全体サマリ
展開して読む
全体トレンド
今週の KEV 新規登録 5 件はすべてリモート攻撃可能（AV:N）で、うち 3 件が CVSS 9.0 以上と深刻度が高い傾向にあります。ただし対象はエンタープライズ製品（Oracle ミドルウェア、TrueConf、Zimbra）および ML 基盤（MLflow）に偏っており、自社の運用対象 OSS とは重なりが小さい可能性があります。一方で主要製品側は 8/19〜8/21 に JDK 系・Go・Spring 系・Next.js が揃って更新されており、四半期セキュリティリリースが重なった週と見られます。
特記事項
cve_stats.kev=1 および CVSS 10.0 の CVE-2025-55182 を含みます。この KEV 該当 CVE が実際に自社稼働バージョンへ影響するかは、公式アドバイザリ（GitHub Security Advisory / Vercel のセキュリティ告知）で個別確認することを強く推奨します。ランク付け上は入力データの is_major_product フラグに従い ★★★ には該当しませんでしたが、実運用上は最優先で確認すべき対象の可能性があります。cve_stats はサイクル単位の累積件数と見られ、今回の更新で新規修正された件数とは一致しない可能性があります。PoC 検証を推奨する CVE と環境構築の骨子
CVE-2025-55182（Next.js, CVSS 10.0）について、外部公開経路の有無を確認する目的で検証環境の用意を推奨します。実際の攻撃コードは記載せず、脆弱／修正済みバージョンの挙動差分を観測できる骨子のみ示します。
# docker-compose.yml（骨子）
services:
next-vuln:
image: node:22-alpine
working_dir: /app
command: sh -c "npm i next@16.3.1 react react-dom && npm run build && npm start"
ports: ["3001:3000"]
volumes: ["./app:/app"]
next-fixed:
image: node:22-alpine
working_dir: /app
command: sh -c "npm i next@16.3.2 react react-dom && npm run build && npm start"
ports: ["3002:3000"]
volumes: ["./app:/app"]
# リクエスト/レスポンスの差分観測用（任意）
proxy:
image: mitmproxy/mitmproxy
command: mitmdump -p 8080 --set confdir=/home/mitmproxy/.mitmproxy
ports: ["8080:8080"]
検証手順の方針: 同一の最小アプリを両コンテナで起動し、公式アドバイザリに記載された影響条件（該当するレンダリングモードやミドルウェア構成など）を満たす設定を再現したうえで、正常系リクエストに対するレスポンスの差分を比較します。攻撃ペイロードは公式アドバイザリまたは信頼できる公開 PoC を参照し、閉じたネットワーク内でのみ実施してください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-20",
"to": "2026-08-26",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 13,
"by_date": {
"2026-08-25": {
"kev_new": 1,
"software_update": 0
},
"2026-08-22": {
"kev_new": 1,
"software_update": 1
},
"2026-08-21": {
"kev_new": 2,
"software_update": 5
},
"2026-08-20": {
"kev_new": 1,
"software_update": 7
}
}
},
"kev_new": [
{
"digest_date": "2026-08-25",
"key": "CVE-2026-21962",
"cve_id": "CVE-2026-21962",
"vendor_project": "Oracle",
"product": "HTTP Server and Oracle Weblogic Server Proxy Plug-in",
"vulnerability_name": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
"date_added": "2026-08-24",
"short_description": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.",
"required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"due_date": "2026-08-27",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in O",
"epss_score": 0.4323
},
{
"digest_date": "2026-08-22",
"key": "CVE-2026-73570",
"cve_id": "CVE-2026-73570",
"vendor_project": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)",
"vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability",
"date_added": "2026-08-21",
"short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-24",
"known_ransomware": "Unknown",
"cvss_score": 8.9,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"epss_score": 0.00539
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72529",
"cve_id": "CVE-2026-72529",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Missing Authentication for Critical Function Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-23",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.",
"epss_score": 0.00284
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72530",
"cve_id": "CVE-2026-72530",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Code Injection Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-03",
"known_ransomware": "Unknown",
"cvss_score": 9.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"epss_score": 0.0034
},
{
"digest_date": "2026-08-20",
"key": "CVE-2026-64849",
"cve_id": "CVE-2026-64849",
"vendor_project": "MLflow",
"product": "MLflow",
"vulnerability_name": "MLflow Server-Side Request Forgery Vulnerability",
"date_added": "2026-08-19",
"short_description": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-02",
"known_ransomware": "Unknown",
"cvss_score": 9.3,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and",
"epss_score": 0.01109
}
],
"software_update": [
{
"digest_date": "2026-08-22",
"key": "nextjs:16",
"product": "nextjs",
"category": "framework",
"cycle": "16",
"latest": "16.3.2",
"release_date": "2025-10-22",
"latest_release_date": "2026-08-21",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 31,
"critical": 1,
"high": 12,
"medium": 17,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-55182",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-44578",
"severity": "HIGH",
"score": 8.6
},
{
"cve_id": "CVE-2026-64642",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "elasticsearch:9.5",
"product": "elasticsearch",
"category": "database",
"cycle": "9.5",
"latest": "9.5.2",
"release_date": "2026-08-04",
"latest_release_date": "2026-08-20",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 0,
"medium": 6,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-37731",
"severity": "MEDIUM",
"score": 6.8
},
{
"cve_id": "CVE-2026-49090",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2025-68384",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "laravel:11",
"product": "laravel",
"category": "framework",
"cycle": "11",
"latest": "11.56.0",
"release_date": "2024-03-12",
"latest_release_date": "2026-08-20",
"eol_date": "2026-03-12",
"support_date": "2025-09-03",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.0",
"product": "spring-boot",
"category": "framework",
"cycle": "4.0",
"latest": "4.0.8",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.1",
"product": "spring-boot",
"category": "framework",
"cycle": "4.1",
"latest": "4.1.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-framework:7.0",
"product": "spring-framework",
"category": "framework",
"cycle": "7.0",
"latest": "7.0.9",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 9,
"critical": 0,
"high": 3,
"medium": 5,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-41849",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41842",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41850",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:17",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.1+1",
"release_date": "2021-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2027-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:21",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.1+1",
"release_date": "2023-10-10",
"latest_release_date": "2026-08-19",
"eol_date": "2029-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "eclipse-temurin:25",
"product": "eclipse-temurin",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.1+1",
"release_date": "2025-09-22",
"latest_release_date": "2026-08-19",
"eol_date": "2031-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.25",
"product": "go",
"category": "programming",
"cycle": "1.25",
"latest": "1.25.14",
"release_date": "2025-08-12",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "go:1.26",
"product": "go",
"category": "programming",
"cycle": "1.26",
"latest": "1.26.7",
"release_date": "2026-02-10",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 26,
"critical": 3,
"high": 13,
"medium": 8,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-68121",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-27143",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2025-66630",
"severity": "CRITICAL",
"score": 9.4
}
]
}
},
{
"digest_date": "2026-08-20",
"key": "microsoft-build-of-openjdk:11",
"product": "microsoft-build-of-openjdk",
"category": "programming",
"cycle": "11",
"latest": "11.0.32.1",
"release_date": "2019-01-21",
"latest_release_date": "2026-08-19",
"eol_date": "2027-09-30",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-20",
"key": "nginx:1.31",
"product": "nginx",
"category": "webserver",
"cycle": "1.31",
"latest": "1.31.4",
"release_date": "2026-05-13",
"latest_release_date": "2026-08-19",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
}
]
}