📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 2
|
更新ソフト 5
|
対象期間 7日
|
生成 2026-10-08 11:00:34
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| jenkins | 2.585 | 2026-10-06 | 279 | 19 | 65 | 4 | ⚠️要確認 |
| caddy | 2.11.7 | 2026-10-03 | 20 | 5 | 7 | 1 | ⚠️要確認 |
| mediawiki (1.46) | 1.46.1 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.45) | 1.45.5 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.43) | 1.43.10 | 2026-10-02 | 409 | 20 | 75 | 0 | ⚠️要確認 |
非主要製品の更新: 0件（OS ディストリ／Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（新たに KEV に追加された CVE は 2 件ありますが、どちらも主要製品（PRODUCTS 辞書の登録製品）ではないため ★★ に分類しています。）
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| — | — | — | — | — | — |
🟠 ★★ 参考 CVE
展開して表示 (2件)
📝 AI 全体サマリ
展開して読む
- Jenkins 2.585: 過去の KEV 該当 CVE（CVE-2024-23897 など）を含む累計値です。still_vulnerable は 0 です。週次版（weekly）と LTS のどちらを使っているかを確認し、今回のリリースにセキュリティ修正が含まれるか公式セキュリティアドバイザリで確認することを推奨します。
- Caddy 2.11.7: 2026 年採番の Critical（CVE-2026-27590 / CVE-2026-27587）が上位に入っています。比較的新しい修正の可能性があるため、自社の Caddy のバージョンを確認し、計画的に更新することを推奨します。
- MediaWiki 1.43 系: still_vulnerable が 7 件と表示されています。最新版の 1.43.10 でも未修正の CVE が残っている可能性があるため、公式アドバイザリで確認してください。また 1.45 系は 2026-12-31 に EOL を迎えます。1.45 を使っている場合は、1.46 か LTS（1.43）への移行計画を前倒しで検討してください。
# docker-compose.yml（骨子）— 隔離ネットワーク上の検証環境専用
# 公式 zammad-docker-compose をベースに、修正前のバージョンへ固定する想定
services:
zammad-railsserver:
image: ghcr.io/zammad/zammad:<修正前バージョン> # 公式アドバイザリで影響バージョンを確認
depends_on: [zammad-postgresql, zammad-redis]
networks: [lab]
zammad-nginx:
image: ghcr.io/zammad/zammad:<修正前バージョン>
command: ["zammad-nginx"]
ports: ["127.0.0.1:8080:8080"] # ローカルのみに公開
networks: [lab]
zammad-postgresql:
image: postgres:<対応バージョン>
networks: [lab]
zammad-redis:
image: redis:<対応バージョン>
networks: [lab]
networks:
lab:
internal: true # 外部への通信を遮断
- 確認したい観点: セッション ID がログインの前後で再発行されるか（修正版と比べる）、zammad ユーザーから root への昇格経路（sudoers やサービス設定など）が修正版で塞がれているか。
- 修正版のイメージを並べて構築し、差分を比べる構成を推奨します。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-02",
"to": "2026-10-08",
"days": 7
},
"summary": {
"total_kev_new": 2,
"total_software_update": 5,
"by_date": {
"2026-10-07": {
"kev_new": 0,
"software_update": 1
},
"2026-10-04": {
"kev_new": 0,
"software_update": 1
},
"2026-10-03": {
"kev_new": 2,
"software_update": 3
}
}
},
"kev_new": [
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102489",
"cve_id": "CVE-2026-102489",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Session Fixation Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.",
"epss_score": 0.00582
},
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102490",
"cve_id": "CVE-2026-102490",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
"epss_score": 0.00262
}
],
"software_update": [
{
"digest_date": "2026-10-07",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.585",
"release_date": "2016-04-20",
"latest_release_date": "2026-10-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 279,
"critical": 19,
"high": 65,
"medium": 181,
"low": 14,
"kev": 4,
"top_cves": [
{
"cve_id": "CVE-2017-1000353",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2016-0791",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2024-23897",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-04",
"key": "caddy:2",
"product": "caddy",
"category": "webserver",
"cycle": "2",
"latest": "2.11.7",
"release_date": "2020-05-04",
"latest_release_date": "2026-10-03",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 5,
"high": 7,
"medium": 7,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-27590",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2018-21246",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-27587",
"severity": "CRITICAL",
"score": 9.1
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.43",
"product": "mediawiki",
"category": "cms",
"cycle": "1.43",
"latest": "1.43.10",
"release_date": "2024-12-21",
"latest_release_date": "2026-10-02",
"eol_date": "2027-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 409,
"critical": 20,
"high": 75,
"medium": 301,
"low": 13,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-58025",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-36128",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 7
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.45",
"product": "mediawiki",
"category": "cms",
"cycle": "1.45",
"latest": "1.45.5",
"release_date": "2025-12-04",
"latest_release_date": "2026-10-02",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2014-9487",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2015-8009",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2017-0372",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.46",
"product": "mediawiki",
"category": "cms",
"cycle": "1.46",
"latest": "1.46.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-10-02",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2021-31556",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2022-29904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
}
]
}