📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 4
|
更新ソフト 8
|
対象期間 7日
|
生成 2026-10-03 15:41:42
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| mediawiki (1.46) | 1.46.1 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.45) | 1.45.5 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.43) | 1.43.10 | 2026-10-02 | 409 | 20 | 75 | 0 | ⚠️要確認 |
| ubuntu (24.04) | 24.04.5 | 2026-09-30 | 3114 | 268 | 1177 | 40 | ⚠️要確認 |
| amazon-corretto (25) | 25.0.4.10.1 | 2026-09-26 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-corretto (21) | 21.0.12.12.1 | 2026-09-26 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-corretto (17) | 17.0.20.12.1 | 2026-09-26 | 0 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 1件（firefox 157.0。クライアント向けブラウザのため、サーバ運用での要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（今週 KEV に追加された CVE はすべて非主要製品でした。主要製品 MediaWiki の CVE-2026-58025 は CVSS 9.8 ですが、攻撃元区分(AV)と KEV の情報がないため ★★ に入れています。）
🟠 ★★ 参考 CVE
展開して表示 (5件)
📝 AI 全体サマリ
展開して読む
- MediaWiki: 1.43 系の still_vulnerable: 7 は、最新版でも未修正の CVE が残っている可能性を示しているように見えます。1.43 系を使っていれば、上位の系列へ移ることも検討するとよさそうです。1.45 系は EOL が 2026-12-31 と近く、1.46 系への移行計画を立てておくことをお勧めします。
- Ubuntu 24.04.5: KEV 40 件は過去分を含む累計値とみられ、今回のリリースで新たに出たものではない可能性が高いです。24.04 で動いているサーバは、通常の apt upgrade で追従しているかを確認する程度でよいと考えられます。
- Amazon Corretto: 紐づく CVE はありません。定例更新として計画的に適用すれば問題なさそうです。Log4j などの Java 系ミドルウェアを動かしているホストでは、ランタイム更新後の動作確認をお勧めします。
- Zammad: KEV 追加の 2 件は組み合わせて悪用できる CVE です。使っていれば、公式アドバイザリに沿って早めの更新が望ましいです。
# docker-compose.yml（骨子・検証用の隔離ネットワーク内のみで使う）
services:
db:
image: mariadb:11
environment:
MARIADB_DATABASE: wiki
MARIADB_USER: wiki
MARIADB_PASSWORD: change-me
MARIADB_RANDOM_ROOT_PASSWORD: "1"
networks: [lab]
mw-vuln:
image: mediawiki:1.45.4 # 修正前（タグは公式アドバイザリで確認）
depends_on: [db]
ports: ["127.0.0.1:8081:80"]
networks: [lab]
mw-fixed:
image: mediawiki:1.45.5 # 修正後
depends_on: [db]
ports: ["127.0.0.1:8082:80"]
networks: [lab]
networks:
lab:
internal: false # 初期セットアップ後は true にして外部への通信を遮断
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-27",
"to": "2026-10-03",
"days": 7
},
"summary": {
"total_kev_new": 4,
"total_software_update": 8,
"by_date": {
"2026-10-03": {
"kev_new": 2,
"software_update": 3
},
"2026-10-01": {
"kev_new": 1,
"software_update": 1
},
"2026-09-30": {
"kev_new": 1,
"software_update": 1
},
"2026-09-27": {
"kev_new": 0,
"software_update": 3
}
}
},
"kev_new": [
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102489",
"cve_id": "CVE-2026-102489",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Session Fixation Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.",
"epss_score": 0.00582
},
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102490",
"cve_id": "CVE-2026-102490",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
"epss_score": 0.00262
},
{
"digest_date": "2026-10-01",
"key": "CVE-2026-76504",
"cve_id": "CVE-2026-76504",
"vendor_project": "Cisco",
"product": "Catalyst SD-WAN Manager",
"vulnerability_name": "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
"date_added": "2026-09-30",
"short_description": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-03",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request t",
"epss_score": null
},
{
"digest_date": "2026-09-30",
"key": "CVE-2026-86950",
"cve_id": "CVE-2026-86950",
"vendor_project": "Apple",
"product": "Multiple Products",
"vulnerability_name": "Apple Multiple Products Out-of-Bounds Write Vulnerability",
"date_added": "2026-09-29",
"short_description": "Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-02",
"known_ransomware": "Unknown",
"cvss_score": 8.8,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.",
"epss_score": 0.00812
}
],
"software_update": [
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.43",
"product": "mediawiki",
"category": "cms",
"cycle": "1.43",
"latest": "1.43.10",
"release_date": "2024-12-21",
"latest_release_date": "2026-10-02",
"eol_date": "2027-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 409,
"critical": 20,
"high": 75,
"medium": 301,
"low": 13,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-58025",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-36128",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 7
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.45",
"product": "mediawiki",
"category": "cms",
"cycle": "1.45",
"latest": "1.45.5",
"release_date": "2025-12-04",
"latest_release_date": "2026-10-02",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2014-9487",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2015-8009",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2017-0372",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.46",
"product": "mediawiki",
"category": "cms",
"cycle": "1.46",
"latest": "1.46.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-10-02",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2021-31556",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2022-29904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-01",
"key": "ubuntu:24.04",
"product": "ubuntu",
"category": "os",
"cycle": "24.04",
"latest": "24.04.5",
"release_date": "2024-04-25",
"latest_release_date": "2026-09-30",
"eol_date": "2029-05-31",
"support_date": "2029-05-31",
"is_major_product": true,
"cve_stats": {
"total": 3114,
"critical": 268,
"high": 1177,
"medium": 1482,
"low": 187,
"kev": 40,
"top_cves": [
{
"cve_id": "CVE-2014-0474",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2013-0767",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2018-18505",
"severity": "CRITICAL",
"score": 10.0
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-30",
"key": "firefox:157",
"product": "firefox",
"category": "browser",
"cycle": "157",
"latest": "157.0",
"release_date": "2026-09-29",
"latest_release_date": "2026-09-29",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-27",
"key": "amazon-corretto:17",
"product": "amazon-corretto",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.12.1",
"release_date": "2021-08-24",
"latest_release_date": "2026-09-26",
"eol_date": "2029-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-27",
"key": "amazon-corretto:21",
"product": "amazon-corretto",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.12.1",
"release_date": "2023-08-21",
"latest_release_date": "2026-09-26",
"eol_date": "2030-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-27",
"key": "amazon-corretto:25",
"product": "amazon-corretto",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.10.1",
"release_date": "2025-09-17",
"latest_release_date": "2026-09-26",
"eol_date": "2032-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
}
]
}