📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 6
|
更新ソフト 0
|
対象期間 7日
|
生成 2026-09-20 19:58:49
📦 更新された主要ソフトウェア
主要ソフトの更新なし
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（今回のダイジェストに含まれる 6 件はいずれも is_major_product=false で、CVSS も 9.0 以上のものが無く、ransomware も Unknown のため ★★★ の条件を満たすものはありません）
🟠 ★★ 参考 CVE
展開して表示 (6件)
📝 AI 全体サマリ
展開して読む
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-14",
"to": "2026-09-20",
"days": 7
},
"summary": {
"total_kev_new": 6,
"total_software_update": 0,
"by_date": {
"2026-09-19": {
"kev_new": 3,
"software_update": 0
},
"2026-09-17": {
"kev_new": 3,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-09-19",
"key": "CVE-2025-39682",
"cve_id": "CVE-2025-39682",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-19",
"key": "CVE-2025-39964",
"cve_id": "CVE-2025-39964",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Race Condition Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-19",
"key": "CVE-2026-53266",
"cve_id": "CVE-2026-53266",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Out-of-Bounds Write Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and wo",
"epss_score": 0.00121
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-58704",
"cve_id": "CVE-2026-58704",
"vendor_project": "Google",
"product": "Pixel",
"vulnerability_name": "Google Pixel Improper Authorization Vulnerability",
"date_added": "2026-09-16",
"short_description": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": 8.8,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "A",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"epss_score": 0.00112
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-76460",
"cve_id": "CVE-2026-76460",
"vendor_project": "Cisco",
"product": "Identity Services Engine",
"vulnerability_name": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
"date_added": "2026-09-16",
"short_description": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-87886",
"cve_id": "CVE-2026-87886",
"vendor_project": "Acronis",
"product": "Backup",
"vulnerability_name": "Acronis Backup Incorrect Default Permissions Vulnerability",
"date_added": "2026-09-16",
"short_description": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": []
}