📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 7
|
対象期間 7日
|
生成 2026-08-27 11:00:59
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| jenkins | 2.579 | 2026-08-25 | 16 | 0 | 5 | 0 | 🟠重要 |
| nextjs | 16.3.2 | 2026-08-21 | 31 | 1 | 12 | 1 | ⚠️要確認 |
| elasticsearch | 9.5.2 | 2026-08-20 | 6 | 0 | 0 | 0 | ✅計画 |
| laravel | 11.56.0 | 2026-08-20 | 0 | 0 | 0 | 0 | ✅計画 |
| spring-boot (4.0) | 4.0.8 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-boot (4.1) | 4.1.1 | 2026-08-20 | 7 | 1 | 4 | 0 | ⚠️要確認 |
| spring-framework (7.0) | 7.0.9 | 2026-08-20 | 9 | 0 | 3 | 0 | 🟠重要 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| CVE-2025-55182 | Next.js (16.3.2 系) | 10.0 | ✓ | N | パッチ即時 |
cve_stats 上で kev=1 / critical=1 が計上されているため、最上位ランクとして扱っています。ただし本ダイジェストの kev_new 一覧には当該 CVE が含まれておらず、KEV 収載の時期・対象バージョン範囲は公式アドバイザリ（Next.js セキュリティアドバイザリおよび CISA KEV カタログ）で確認が必要です。🟠 ★★ 参考 CVE
展開して表示 (4件)
attack_vector 情報が本データに含まれず is_remote が未判定のため ★★ に留めた。Spring Boot は自社運用対象に該当し得るので、実際の攻撃経路と影響コンポーネントは公式アドバイザリ（spring.io security advisories）で確認のうえ、★★★ 相当に格上げする必要がある可能性がある。（参考: CVE-2026-73570 Zimbra ZCS は KEV 収載だが CVSS 8.9 かつ非主要製品のため ★ その他に分類。CVE-2026-60004 Gitea も KEV 収載だが非主要製品・CVSS 未付与で、社内 Git ホスティングに Gitea を使っている場合のみ確認が必要。）
📝 AI 全体サマリ
展開して読む
- Next.js の CVE-2025-55182 (CVSS 10.0) は本データで KEV フラグが立っている一方、kev_new には現れておらず、以前に収載された既知悪用の可能性があります。運用中バージョンが 16.3.2 未満であれば最優先で更新検討をおすすめします。
- Spring Boot の CVE-2026-40976 は 4.0 系・4.1 系の双方に同じ CVE が計上されており、共通コンポーネント由来の可能性があります。片方だけ更新しても解消しないケースが考えられるため、両系統の稼働状況を洗い出したうえで対応するのが安全と思われます。
- Laravel 11 系は CVE 0 件ですが eol_date が 2026-03-12 で既に期限を過ぎており、今後セキュリティ修正が提供されない可能性があります。CVE 件数だけを見ると安全に見える点に注意し、上位系統への移行計画を別途検討すべき状況とみられます。Spring Boot 4.0 系（EOL 2026-12-31）も年内に期限を迎えます。
- Gitea の CVE-2026-60004 はリポジトリ書き込み権限を持つ攻撃者が Git hook を仕込めるとされており、社内で Gitea を自前ホストしている場合は「非主要製品」扱いでも実質的な影響が大きくなる可能性があります。運用対象台帳の確認をおすすめします。
# docker-compose.yml（骨子のみ。実際のバージョンは公式アドバイザリの影響範囲に合わせる）
services:
nextjs-vuln:
image: node:22-bookworm
working_dir: /app
command: sh -c "npx --yes create-next-app@<脆弱版> app && cd app && npm run dev"
ports: ["3000:3000"]
nextjs-fixed:
image: node:22-bookworm
working_dir: /app
command: sh -c "npx --yes create-next-app@16.3.2 app && cd app && npm run dev"
ports: ["3001:3000"]
springboot-vuln:
image: eclipse-temurin:21-jre
volumes: ["./springboot-vuln:/app"] # 脆弱版でビルドした jar を配置
command: java -jar /app/app.jar
ports: ["8080:8080"]
springboot-fixed:
image: eclipse-temurin:21-jre
volumes: ["./springboot-fixed:/app"] # 4.0.8 / 4.1.1 でビルドした jar を配置
command: java -jar /app/app.jar
ports: ["8081:8080"]
検証の進め方（案）: ①公式アドバイザリで影響コンポーネントとバージョン範囲を確定 → ②上記の脆弱版／修正版を並べて起動 → ③該当エンドポイントへの正常系リクエストで挙動差分（レスポンス・ログ・スタックトレース）を比較 → ④自社アプリの構成が影響条件を満たすかを判定。検証はインターネットから隔離したネットワーク上で実施し、成果物は破棄する運用が望ましいと考えられます。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-21",
"to": "2026-08-27",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 7,
"by_date": {
"2026-08-26": {
"kev_new": 1,
"software_update": 1
},
"2026-08-25": {
"kev_new": 1,
"software_update": 0
},
"2026-08-22": {
"kev_new": 1,
"software_update": 1
},
"2026-08-21": {
"kev_new": 2,
"software_update": 5
}
}
},
"kev_new": [
{
"digest_date": "2026-08-26",
"key": "CVE-2026-60004",
"cve_id": "CVE-2026-60004",
"vendor_project": "Gitea",
"product": "Gitea",
"vulnerability_name": "Gitea Code Injection Vulnerability",
"date_added": "2026-08-25",
"short_description": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-28",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-25",
"key": "CVE-2026-21962",
"cve_id": "CVE-2026-21962",
"vendor_project": "Oracle",
"product": "HTTP Server and Oracle Weblogic Server Proxy Plug-in",
"vulnerability_name": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
"date_added": "2026-08-24",
"short_description": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.",
"required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"due_date": "2026-08-27",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in O",
"epss_score": 0.4323
},
{
"digest_date": "2026-08-22",
"key": "CVE-2026-73570",
"cve_id": "CVE-2026-73570",
"vendor_project": "Synacor",
"product": "Zimbra Collaboration Suite (ZCS)",
"vulnerability_name": "Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability",
"date_added": "2026-08-21",
"short_description": "Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-24",
"known_ransomware": "Unknown",
"cvss_score": 8.9,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.",
"epss_score": 0.00539
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72529",
"cve_id": "CVE-2026-72529",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Missing Authentication for Critical Function Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-23",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.",
"epss_score": 0.00284
},
{
"digest_date": "2026-08-21",
"key": "CVE-2026-72530",
"cve_id": "CVE-2026-72530",
"vendor_project": "TrueConf",
"product": "Server",
"vulnerability_name": "TrueConf Server Code Injection Vulnerability",
"date_added": "2026-08-20",
"short_description": "TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-03",
"known_ransomware": "Unknown",
"cvss_score": 9.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.",
"epss_score": 0.0034
}
],
"software_update": [
{
"digest_date": "2026-08-26",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.579",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-25",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
},
{
"digest_date": "2026-08-22",
"key": "nextjs:16",
"product": "nextjs",
"category": "framework",
"cycle": "16",
"latest": "16.3.2",
"release_date": "2025-10-22",
"latest_release_date": "2026-08-21",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 31,
"critical": 1,
"high": 12,
"medium": 17,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-55182",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2026-44578",
"severity": "HIGH",
"score": 8.6
},
{
"cve_id": "CVE-2026-64642",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "elasticsearch:9.5",
"product": "elasticsearch",
"category": "database",
"cycle": "9.5",
"latest": "9.5.2",
"release_date": "2026-08-04",
"latest_release_date": "2026-08-20",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 6,
"critical": 0,
"high": 0,
"medium": 6,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-37731",
"severity": "MEDIUM",
"score": 6.8
},
{
"cve_id": "CVE-2026-49090",
"severity": "MEDIUM",
"score": 6.5
},
{
"cve_id": "CVE-2025-68384",
"severity": "MEDIUM",
"score": 6.5
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "laravel:11",
"product": "laravel",
"category": "framework",
"cycle": "11",
"latest": "11.56.0",
"release_date": "2024-03-12",
"latest_release_date": "2026-08-20",
"eol_date": "2026-03-12",
"support_date": "2025-09-03",
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": []
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.0",
"product": "spring-boot",
"category": "framework",
"cycle": "4.0",
"latest": "4.0.8",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-boot:4.1",
"product": "spring-boot",
"category": "framework",
"cycle": "4.1",
"latest": "4.1.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 7,
"critical": 1,
"high": 4,
"medium": 2,
"low": 0,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-40976",
"severity": "CRITICAL",
"score": 9.1
},
{
"cve_id": "CVE-2026-22731",
"severity": "HIGH",
"score": 8.2
},
{
"cve_id": "CVE-2026-22733",
"severity": "HIGH",
"score": 8.2
}
]
}
},
{
"digest_date": "2026-08-21",
"key": "spring-framework:7.0",
"product": "spring-framework",
"category": "framework",
"cycle": "7.0",
"latest": "7.0.9",
"release_date": "2025-11-30",
"latest_release_date": "2026-08-20",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 9,
"critical": 0,
"high": 3,
"medium": 5,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-41849",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41842",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2026-41850",
"severity": "HIGH",
"score": 7.5
}
]
}
}
]
}