📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 4
|
更新ソフト 6
|
対象期間 7日
|
生成 2026-10-04 15:32:24
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| caddy | 2.11.7 | 2026-10-03 | 20 | 5 | 7 | 1 | ⚠️要確認 |
| mediawiki (1.43) | 1.43.10 | 2026-10-02 | 409 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.45) | 1.45.5 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.46) | 1.46.1 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| ubuntu | 24.04.5 | 2026-09-30 | 3114 | 268 | 1177 | 40 | ⚠️要確認 |
非主要製品 の更新: 1件（firefox 157.0。ブラウザのため端末管理側の通常更新で足りる見込みで、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（今回 KEV に新しく追加された 4 件は、いずれも is_major_product=false でした。主要製品側の caddy に KEV 該当が 1 件ありますが、CVE ID・AV・is_remote が入力データに含まれていないため、★★★ かどうかは判定していません。下のサマリを参照してください。）
🟠 ★★ 参考 CVE
展開して表示 (4件)
📝 AI 全体サマリ
展開して読む
still_vulnerable=0 なので、最新版に上げれば既知の CVE は解消される可能性があります。caddy を使っている環境があれば、パッチ計画適用を優先するのがよさそうです。still_vulnerable=7 で、最新の 1.43.10 にしても未修正の CVE が 7 件残る可能性があります。1.43 系を使っている場合は、未修正分の内容を公式のセキュリティリリース告知で確認してください。そのうえで 1.46 系（EOL 2027-07-31）への移行を検討するとよさそうです。apt update && apt upgrade を定期的に回していれば通常の運用で足ります。unattended-upgrades が止まっているホストがないかは確認したほうがよさそうです。- caddy（KEV 該当分）: 自社で使っていれば、該当 CVE が特定できた段階で、旧版と 2.11.7 の挙動差を検証環境で比べる価値があると思います。環境の骨子は次のとおりです（exploit コードは含めていません）。
```yaml
# docker-compose.yml（骨子）
services:
caddy-old:
image: caddy:2.11.6 # 修正前（該当バージョンは公式アドバイザリで確認）
ports: ["8081:80"]
volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro"]
caddy-new:
image: caddy:2.11.7 # 修正版
ports: ["8082:80"]
volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro"]
backend:
image: nginx:alpine # reverse_proxy の転送先ダミー
```
- Zammad（CVE-2026-102489 + 102490 の組み合わせ）: 自社で使っていないなら、検証の優先度は低いと思われます。利用が見つかった場合は、公式の zammad-docker-compose リポジトリで修正前と修正後のバージョンを並べて立て、セッション Cookie の扱いの違いやログの出方を観察する程度に留めるのが無難です。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-28",
"to": "2026-10-04",
"days": 7
},
"summary": {
"total_kev_new": 4,
"total_software_update": 6,
"by_date": {
"2026-10-04": {
"kev_new": 0,
"software_update": 1
},
"2026-10-03": {
"kev_new": 2,
"software_update": 3
},
"2026-10-01": {
"kev_new": 1,
"software_update": 1
},
"2026-09-30": {
"kev_new": 1,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102489",
"cve_id": "CVE-2026-102489",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Session Fixation Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.",
"epss_score": 0.00582
},
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102490",
"cve_id": "CVE-2026-102490",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
"epss_score": 0.00262
},
{
"digest_date": "2026-10-01",
"key": "CVE-2026-76504",
"cve_id": "CVE-2026-76504",
"vendor_project": "Cisco",
"product": "Catalyst SD-WAN Manager",
"vulnerability_name": "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
"date_added": "2026-09-30",
"short_description": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-03",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request t",
"epss_score": null
},
{
"digest_date": "2026-09-30",
"key": "CVE-2026-86950",
"cve_id": "CVE-2026-86950",
"vendor_project": "Apple",
"product": "Multiple Products",
"vulnerability_name": "Apple Multiple Products Out-of-Bounds Write Vulnerability",
"date_added": "2026-09-29",
"short_description": "Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-02",
"known_ransomware": "Unknown",
"cvss_score": 8.8,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.",
"epss_score": 0.00812
}
],
"software_update": [
{
"digest_date": "2026-10-04",
"key": "caddy:2",
"product": "caddy",
"category": "webserver",
"cycle": "2",
"latest": "2.11.7",
"release_date": "2020-05-04",
"latest_release_date": "2026-10-03",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 5,
"high": 7,
"medium": 7,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-27590",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2018-21246",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-27587",
"severity": "CRITICAL",
"score": 9.1
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.43",
"product": "mediawiki",
"category": "cms",
"cycle": "1.43",
"latest": "1.43.10",
"release_date": "2024-12-21",
"latest_release_date": "2026-10-02",
"eol_date": "2027-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 409,
"critical": 20,
"high": 75,
"medium": 301,
"low": 13,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-58025",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-36128",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 7
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.45",
"product": "mediawiki",
"category": "cms",
"cycle": "1.45",
"latest": "1.45.5",
"release_date": "2025-12-04",
"latest_release_date": "2026-10-02",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2014-9487",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2015-8009",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2017-0372",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.46",
"product": "mediawiki",
"category": "cms",
"cycle": "1.46",
"latest": "1.46.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-10-02",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2021-31556",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2022-29904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-01",
"key": "ubuntu:24.04",
"product": "ubuntu",
"category": "os",
"cycle": "24.04",
"latest": "24.04.5",
"release_date": "2024-04-25",
"latest_release_date": "2026-09-30",
"eol_date": "2029-05-31",
"support_date": "2029-05-31",
"is_major_product": true,
"cve_stats": {
"total": 3114,
"critical": 268,
"high": 1177,
"medium": 1482,
"low": 187,
"kev": 40,
"top_cves": [
{
"cve_id": "CVE-2014-0474",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2013-0767",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2018-18505",
"severity": "CRITICAL",
"score": 10.0
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-30",
"key": "firefox:157",
"product": "firefox",
"category": "browser",
"cycle": "157",
"latest": "157.0",
"release_date": "2026-09-29",
"latest_release_date": "2026-09-29",
"eol_date": "false",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
}
]
}