📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 2
|
対象期間 7日
|
生成 2026-09-03 11:00:37
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| dovecot | 2.4.5 | 2026-08-28 | 11 | 0 | 4 | 0 | 🟠重要 |
| ubuntu | 26.04.1 | 2026-08-28 | 5 | 0 | 1 | 0 | 🟠重要 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（KEV 新規追加 3 件はいずれも is_major_product=false であり、CVSS も未登録または 5.3 と低めのため、★★★ の条件を満たすものは無いと判断しています。実際の影響有無は公式アドバイザリで確認してください。）
🟠 ★★ 参考 CVE
展開して表示 (2件)
（CVE-2026-66384 / JFrog Artifactory は CVSS 5.3・非主要製品のため ★ その他に分類。認証済みユーザによる Docker キャッシュ外への書き込みという限定的な条件であり、自社影響は低い可能性がある。）
📝 AI 全体サマリ
展開して読む
- dovecot 2.4.5 の top CVE（CVE-2026-24031 CVSS 7.7、CVE-2026-27858 / CVE-2025-59032 いずれも 7.5）は、メールサービスを外部公開している場合に相対的にリスクが上がる可能性がある。公開範囲と認証設定を合わせて確認したい。
- Ubuntu 26.04.1 の CVE-2025-33208（CVSS 8.8）は High だが Critical には至らないため、通常のメンテナンスウィンドウでの適用が妥当と考えられる。
- CVE-2026-53362（Linux Kernel, KEV）は「unspecified」記載のため詳細不明。KEV 掲載＝実際に悪用が観測されている点は軽視できないので、利用中カーネルの版と各ディストリの修正提供状況を公式アドバイザリで確認することを推奨する。
```yaml
# docker-compose.yml（骨子のみ／挙動比較用）
services:
dovecot-old:
image: dovecot/dovecot:2.4.4 # 更新前相当
ports: ["10143:143", "10993:993"]
volumes:
- ./conf-old:/etc/dovecot:ro
- ./mail-old:/srv/mail
dovecot-new:
image: dovecot/dovecot:2.4.5 # 更新後
ports: ["20143:143", "20993:993"]
volumes:
- ./conf-new:/etc/dovecot:ro
- ./mail-new:/srv/mail
# 使い方の方針:
# - 隔離ネットワーク（外部到達不可）に閉じて起動する
# - 同一設定・同一テストメールボックスを両者に与え、公式アドバイザリ記載の
# 影響条件（設定項目・プロトコル経路）が有効かどうかを設定差分として確認する
# - 実際の攻撃コードは用いず、ログ／バージョン挙動の比較にとどめる
```
なお具体的な影響条件・修正内容は dovecot 公式リリースノートおよび各 CVE のベンダアドバイザリで確認する必要がある。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-28",
"to": "2026-09-03",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 2,
"by_date": {
"2026-08-29": {
"kev_new": 0,
"software_update": 2
},
"2026-08-28": {
"kev_new": 3,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-08-28",
"key": "CVE-2023-49105",
"cve_id": "CVE-2023-49105",
"vendor_project": "ownCloud",
"product": "ownCloud",
"vulnerability_name": "ownCloud Improper Authentication Vulnerability",
"date_added": "2026-08-27",
"short_description": "ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-30",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-28",
"key": "CVE-2026-53362",
"cve_id": "CVE-2026-53362",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Unspecified Vulnerability",
"date_added": "2026-08-27",
"short_description": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-30",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap ",
"epss_score": 0.00265
},
{
"digest_date": "2026-08-28",
"key": "CVE-2026-66384",
"cve_id": "CVE-2026-66384",
"vendor_project": "JFrog",
"product": "Artifactory",
"vulnerability_name": "JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
"date_added": "2026-08-27",
"short_description": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-10",
"known_ransomware": "Unknown",
"cvss_score": 5.3,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.",
"epss_score": 0.00264
}
],
"software_update": [
{
"digest_date": "2026-08-29",
"key": "dovecot:2.4",
"product": "dovecot",
"category": "middleware",
"cycle": "2.4",
"latest": "2.4.5",
"release_date": "2025-01-24",
"latest_release_date": "2026-08-28",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 11,
"critical": 0,
"high": 4,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-24031",
"severity": "HIGH",
"score": 7.7
},
{
"cve_id": "CVE-2026-27858",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-59032",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-29",
"key": "ubuntu:26.04",
"product": "ubuntu",
"category": "os",
"cycle": "26.04",
"latest": "26.04.1",
"release_date": "2026-04-23",
"latest_release_date": "2026-08-28",
"eol_date": "2031-04-30",
"support_date": "2031-04-30",
"is_major_product": true,
"cve_stats": {
"total": 5,
"critical": 0,
"high": 1,
"medium": 2,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-33208",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2025-6966",
"severity": "MEDIUM",
"score": 5.5
},
{
"cve_id": "CVE-2026-47335",
"severity": "MEDIUM",
"score": 5.5
}
]
}
}
]
}