📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 8
|
対象期間 7日
|
生成 2026-10-10 15:28:54
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| TYPO3 (13) | 13.4.36 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (14) | 14.3.8 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (12) | 12.4.50 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (11) | 11.5.55 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (10) | 10.4.61 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| Node.js (26) | 26.11.1 | 2026-10-08 | 189 | 18 | 104 | 1 | ⚠️要確認 |
| Jenkins (2) | 2.585 | 2026-10-06 | 279 | 19 | 65 | 4 | ⚠️要確認 |
| Caddy (2) | 2.11.7 | 2026-10-03 | 20 | 5 | 7 | 1 | ⚠️要確認 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD (mod_copy) | 10.0 | ✓ | N | パッチ即時 |
| CVE-2016-3081 | Apache Struts | 8.1 | ✓ | N | パッチ即時 |
| CVE-2015-5477 | ISC BIND | 7.8 | ✓ | N | パッチ計画適用 |
🟠 ★★ 参考 CVE
展開して表示 (2件)
📝 AI 全体サマリ
展開して読む
- ProFTPD (CVE-2015-3306): mod_copy の SITE CPFR/CPTO コマンドで、認証なしに任意のファイルをコピーできる問題です。EPSS も 0.97 と非常に高いです。パッチを当てられない場合は、mod_copy を無効化すれば緩和できる可能性があります。公式アドバイザリで確認してください。
- Apache Struts (CVE-2016-3081): Dynamic Method Invocation（DMI）が有効な場合に限って RCE が成立します。まず struts.enable.DynamicMethodInvocation の設定値と Struts のバージョンを確認してください。
- ISC BIND (CVE-2015-5477): TKEY クエリによる DoS（サービス停止）で、コード実行にはつながりません。現行のディストリ版 BIND であれば修正済みの可能性が高いです。そのため「パッチ計画適用」としましたが、古い OS に残っているサーバがあれば優先度を上げてください。
- TYPO3 の 5 系列は CVE 統計がすべて同じ値です。これは系列ごとの数字ではなく製品全体の累計とみられ、still_vulnerable=0 なので最新版では既知 CVE は解消されている可能性があります。ただし系列 10 / 11 / 12 はすでに EOL を過ぎています（12 は 2026-04-30 に EOL）。今回の更新は ELTS（有償延長サポート）向けの可能性があるため、該当系列を使っている場合は 13 / 14 への移行計画を確認してください。
- Jenkins（KEV 4 件。CVE-2024-23897 などを含む）、Node.js（KEV 1 件。CVE-2026-21636 は CVSS 10.0）、Caddy（KEV 1 件。CVE-2026-27590 は CVSS 9.8）は、どれも統計上 Critical / KEV があるため「⚠️要確認」としています。累計の数字なので、今回のリリースで直った CVE が何かは、それぞれのリリースノートで確認してください。
- Caddy のリリース日（2026-10-03）は集計期間（10-04〜10-10）の前日ですが、ダイジェストの日付が 10-04 のため掲載しています。
# docker-compose.yml（骨子）— 外部ネットワークから隔離して使用
services:
proftpd-vuln:
build: ./proftpd-1.3.5 # mod_copy を有効にした ProFTPD 1.3.5 をソースからビルド
networks: [labnet]
volumes:
- ./www:/var/www/html # 書き込み先を観察するための共有ディレクトリ
web:
image: httpd:2.4 # 「Web ルートへ書き込まれるか」の確認用
volumes:
- ./www:/usr/local/apache2/htdocs
networks: [labnet]
attacker:
image: debian:stable-slim # ftp / nc クライアントのみ入れる
networks: [labnet]
command: sleep infinity
networks:
labnet:
internal: true # インターネットへ出られないようにする
- 確認する観点: SITE CPFR/CPTO を受け付けるかどうか、修正版（1.3.5a 以降）で拒否されるか、mod_copy を無効化したときの挙動、ログに何が出るか。Struts の DMI についても、同じ要領で隔離環境を作って設定の違いによる挙動差を確かめられる可能性があります。手順は「脆弱性検証環境の構築」プロジェクトの方針に合わせてください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-04",
"to": "2026-10-10",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 8,
"by_date": {
"2026-10-10": {
"kev_new": 0,
"software_update": 5
},
"2026-10-09": {
"kev_new": 5,
"software_update": 1
},
"2026-10-07": {
"kev_new": 0,
"software_update": 1
},
"2026-10-04": {
"kev_new": 0,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-10-09",
"key": "CVE-2015-3306",
"cve_id": "CVE-2015-3306",
"vendor_project": "ProFTPD",
"product": "ProFTPD",
"vulnerability_name": "ProFTPD Improper Access Control Vulnerability",
"date_added": "2026-10-08",
"short_description": "ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "proftpd",
"title_en": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"epss_score": 0.96752
},
{
"digest_date": "2026-10-09",
"key": "CVE-2015-5477",
"cve_id": "CVE-2015-5477",
"vendor_project": "ISC",
"product": "BIND",
"vulnerability_name": " ISC BIND Data Processing Errors Vulnerability",
"date_added": "2026-10-08",
"short_description": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 7.8,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "bind",
"title_en": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.",
"epss_score": 0.91284
},
{
"digest_date": "2026-10-09",
"key": "CVE-2016-3081",
"cve_id": "CVE-2016-3081",
"vendor_project": "Apache",
"product": "Struts",
"vulnerability_name": "Apache Struts Command Injection Vulnerability",
"date_added": "2026-10-08",
"short_description": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 8.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "apache-struts",
"title_en": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.",
"epss_score": 0.93352
},
{
"digest_date": "2026-10-09",
"key": "CVE-2021-3199",
"cve_id": "CVE-2021-3199",
"vendor_project": "ONLYOFFICE",
"product": "Docs",
"vulnerability_name": "ONLYOFFICE Docs Server Path Traversal Vulnerability",
"date_added": "2026-10-08",
"short_description": "ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-10-09",
"key": "CVE-2023-22894",
"cve_id": "CVE-2023-22894",
"vendor_project": "Strapi",
"product": "Strapi",
"vulnerability_name": "Strapi Cleartext Storage of Sensitive Information Vulnerability",
"date_added": "2026-10-08",
"short_description": "Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-10-10",
"key": "typo3:10",
"product": "typo3",
"category": "cms",
"cycle": "10",
"latest": "10.4.61",
"release_date": "2019-07-23",
"latest_release_date": "2026-10-09",
"eol_date": "2023-04-30",
"support_date": "2021-10-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:11",
"product": "typo3",
"category": "cms",
"cycle": "11",
"latest": "11.5.55",
"release_date": "2020-12-22",
"latest_release_date": "2026-10-09",
"eol_date": "2024-10-31",
"support_date": "2023-03-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:12",
"product": "typo3",
"category": "cms",
"cycle": "12",
"latest": "12.4.50",
"release_date": "2022-10-04",
"latest_release_date": "2026-10-09",
"eol_date": "2026-04-30",
"support_date": "2024-10-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:13",
"product": "typo3",
"category": "cms",
"cycle": "13",
"latest": "13.4.36",
"release_date": "2024-01-30",
"latest_release_date": "2026-10-09",
"eol_date": "2027-12-31",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:14",
"product": "typo3",
"category": "cms",
"cycle": "14",
"latest": "14.3.8",
"release_date": "2025-11-25",
"latest_release_date": "2026-10-09",
"eol_date": "2029-06-30",
"support_date": "2027-12-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-09",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.11.1",
"release_date": "2026-05-05",
"latest_release_date": "2026-10-08",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 189,
"critical": 18,
"high": 104,
"medium": 60,
"low": 7,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2015-0278",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2023-32002",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-07",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.585",
"release_date": "2016-04-20",
"latest_release_date": "2026-10-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 279,
"critical": 19,
"high": 65,
"medium": 181,
"low": 14,
"kev": 4,
"top_cves": [
{
"cve_id": "CVE-2017-1000353",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2016-0791",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2024-23897",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-04",
"key": "caddy:2",
"product": "caddy",
"category": "webserver",
"cycle": "2",
"latest": "2.11.7",
"release_date": "2020-05-04",
"latest_release_date": "2026-10-03",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 5,
"high": 7,
"medium": 7,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-27590",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2018-21246",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-27587",
"severity": "CRITICAL",
"score": 9.1
}
],
"still_vulnerable": 0
}
}
]
}