📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 7
|
更新ソフト 6
|
対象期間 7日
|
生成 2026-10-09 11:00:41
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| Node.js (26系) | 26.11.1 | 2026-10-08 | 189 | 18 | 104 | 1 | ⚠️要確認 |
| Jenkins (2系) | 2.585 | 2026-10-06 | 279 | 19 | 65 | 4 | ⚠️要確認 |
| Caddy (2系) | 2.11.7 | 2026-10-03 | 20 | 5 | 7 | 1 | ⚠️要確認 |
| MediaWiki (1.43系) | 1.43.10 | 2026-10-02 | 409 | 20 | 75 | 0 | ⚠️要確認 |
| MediaWiki (1.45系) | 1.45.5 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| MediaWiki (1.46系) | 1.46.1 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
非主要製品の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD (mod_copy) | 10.0 | ✓ | N | パッチ即時 |
| CVE-2016-3081 | Apache Struts | 8.1 | ✓ | N | パッチ即時 |
| CVE-2015-5477 | ISC BIND | 7.8 | ✓ | N | パッチ即時 |
SITE CPFR / SITE CPTO で任意ファイルの読み書きができる可能性があります。EPSS は 0.968 と非常に高い値です。パッチを当てるまでの暫定策として、mod_copy の無効化が考えられます。method: プレフィックス経由で任意コードが実行される可能性があります。パッチ適用前でも、struts.enable.DynamicMethodInvocation=false にすることで緩和できる可能性があります。🟠 ★★ 参考 CVE
展開して表示 (4件)
📝 AI 全体サマリ
展開して読む
- Jenkins: KEV 該当が 4 件あります。上位に CVE-2024-23897（CLI 経由の任意ファイル読み取り）や CVE-2017-1000353 が並んでいます。インターネットに公開している Jenkins が 2.585 以降、または LTS の修正版になっているかを確認してください。
- MediaWiki 1.43系: still_vulnerable: 7 となっています。最新の 1.43.10 でも未修正の CVE が残っている可能性があるため、公式のセキュリティリリースノートで確認してください。また 1.45系は EoL が 2026-12-31 と近いので、1.46系への移行計画を検討する価値があります。
- Node.js: top_cves に CVE-2015-0278 が CVSS 10.0 / HIGH として出ています。severity とスコアが噛み合っておらず、データ側の紐付け誤り（別製品の CVE の誤マッチ）の可能性があります。
- Caddy: 2026 年の Critical（CVE-2026-27590 / 27587）が上位にあります。2.11.7 で修正されているかどうかは公式リリースノートで確認してください。
```yaml
# docker-compose.yml（骨子のみ・隔離ネットワークで使用）
services:
struts-vuln:
image: <脆弱版 Struts 2.3.x を含む検証用イメージ> # 例: Tomcat + 脆弱版 struts2 サンプルアプリ
ports: ["127.0.0.1:8080:8080"]
environment:
- STRUTS_DMI=true # 該当条件の再現用（緩和確認時は false に切替）
networks: [lab]
proftpd-vuln:
image: <mod_copy 有効の ProFTPD 1.3.5 系イメージ>
ports: ["127.0.0.1:2121:21"]
volumes:
- ./proftpd.conf:/etc/proftpd/proftpd.conf:ro # LoadModule mod_copy.c の有無で比較
networks: [lab]
networks:
lab:
internal: true # 外部への通信を遮断
```
- 検証観点は「該当条件（DMI 有効 / mod_copy ロード）が自社構成にあるか」と「パッチ版・設定変更で再現しなくなるか」の 2 点です。攻撃コードは公式アドバイザリと公開済みの検証手順を参照し、ここでは作成しません。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-03",
"to": "2026-10-09",
"days": 7
},
"summary": {
"total_kev_new": 7,
"total_software_update": 6,
"by_date": {
"2026-10-09": {
"kev_new": 5,
"software_update": 1
},
"2026-10-07": {
"kev_new": 0,
"software_update": 1
},
"2026-10-04": {
"kev_new": 0,
"software_update": 1
},
"2026-10-03": {
"kev_new": 2,
"software_update": 3
}
}
},
"kev_new": [
{
"digest_date": "2026-10-09",
"key": "CVE-2015-3306",
"cve_id": "CVE-2015-3306",
"vendor_project": "ProFTPD",
"product": "ProFTPD",
"vulnerability_name": "ProFTPD Improper Access Control Vulnerability",
"date_added": "2026-10-08",
"short_description": "ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "proftpd",
"title_en": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"epss_score": 0.96752
},
{
"digest_date": "2026-10-09",
"key": "CVE-2015-5477",
"cve_id": "CVE-2015-5477",
"vendor_project": "ISC",
"product": "BIND",
"vulnerability_name": " ISC BIND Data Processing Errors Vulnerability",
"date_added": "2026-10-08",
"short_description": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 7.8,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "bind",
"title_en": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.",
"epss_score": 0.91284
},
{
"digest_date": "2026-10-09",
"key": "CVE-2016-3081",
"cve_id": "CVE-2016-3081",
"vendor_project": "Apache",
"product": "Struts",
"vulnerability_name": "Apache Struts Command Injection Vulnerability",
"date_added": "2026-10-08",
"short_description": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 8.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "apache-struts",
"title_en": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.",
"epss_score": 0.93352
},
{
"digest_date": "2026-10-09",
"key": "CVE-2021-3199",
"cve_id": "CVE-2021-3199",
"vendor_project": "ONLYOFFICE",
"product": "Docs",
"vulnerability_name": "ONLYOFFICE Docs Server Path Traversal Vulnerability",
"date_added": "2026-10-08",
"short_description": "ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-10-09",
"key": "CVE-2023-22894",
"cve_id": "CVE-2023-22894",
"vendor_project": "Strapi",
"product": "Strapi",
"vulnerability_name": "Strapi Cleartext Storage of Sensitive Information Vulnerability",
"date_added": "2026-10-08",
"short_description": "Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102489",
"cve_id": "CVE-2026-102489",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Session Fixation Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.",
"epss_score": 0.00582
},
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102490",
"cve_id": "CVE-2026-102490",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
"epss_score": 0.00262
}
],
"software_update": [
{
"digest_date": "2026-10-09",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.11.1",
"release_date": "2026-05-05",
"latest_release_date": "2026-10-08",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 189,
"critical": 18,
"high": 104,
"medium": 60,
"low": 7,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2015-0278",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2023-32002",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-07",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.585",
"release_date": "2016-04-20",
"latest_release_date": "2026-10-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 279,
"critical": 19,
"high": 65,
"medium": 181,
"low": 14,
"kev": 4,
"top_cves": [
{
"cve_id": "CVE-2017-1000353",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2016-0791",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2024-23897",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-04",
"key": "caddy:2",
"product": "caddy",
"category": "webserver",
"cycle": "2",
"latest": "2.11.7",
"release_date": "2020-05-04",
"latest_release_date": "2026-10-03",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 5,
"high": 7,
"medium": 7,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-27590",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2018-21246",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-27587",
"severity": "CRITICAL",
"score": 9.1
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.43",
"product": "mediawiki",
"category": "cms",
"cycle": "1.43",
"latest": "1.43.10",
"release_date": "2024-12-21",
"latest_release_date": "2026-10-02",
"eol_date": "2027-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 409,
"critical": 20,
"high": 75,
"medium": 301,
"low": 13,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-58025",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-36128",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 7
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.45",
"product": "mediawiki",
"category": "cms",
"cycle": "1.45",
"latest": "1.45.5",
"release_date": "2025-12-04",
"latest_release_date": "2026-10-02",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2014-9487",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2015-8009",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2017-0372",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.46",
"product": "mediawiki",
"category": "cms",
"cycle": "1.46",
"latest": "1.46.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-10-02",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2021-31556",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2022-29904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
}
]
}