📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 7
|
対象期間 7日
|
生成 2026-10-11 11:02:26
直前の回答は安全分類器によって途中で止められたため、後半は表示されていません。止められた部分は再出力しません。
表示済みの部分に誤りが1件あります。
⚠️要確認 のままで変わりません。更新ソフト表、★★★ 要対応 CVE（3件）、★★ 参考 CVE（2件）は出力済みです。AI 全体サマリは途中で切れていて、PoC 検証環境の骨子までは届いていません。日次レポートとしては不完全なので、このまま使う場合はサマリが欠けている点に注意してください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-05",
"to": "2026-10-11",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 7,
"by_date": {
"2026-10-10": {
"kev_new": 0,
"software_update": 5
},
"2026-10-09": {
"kev_new": 5,
"software_update": 1
},
"2026-10-07": {
"kev_new": 0,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-10-09",
"key": "CVE-2015-3306",
"cve_id": "CVE-2015-3306",
"vendor_project": "ProFTPD",
"product": "ProFTPD",
"vulnerability_name": "ProFTPD Improper Access Control Vulnerability",
"date_added": "2026-10-08",
"short_description": "ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "proftpd",
"title_en": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"epss_score": 0.96752
},
{
"digest_date": "2026-10-09",
"key": "CVE-2015-5477",
"cve_id": "CVE-2015-5477",
"vendor_project": "ISC",
"product": "BIND",
"vulnerability_name": " ISC BIND Data Processing Errors Vulnerability",
"date_added": "2026-10-08",
"short_description": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 7.8,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "bind",
"title_en": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.",
"epss_score": 0.91284
},
{
"digest_date": "2026-10-09",
"key": "CVE-2016-3081",
"cve_id": "CVE-2016-3081",
"vendor_project": "Apache",
"product": "Struts",
"vulnerability_name": "Apache Struts Command Injection Vulnerability",
"date_added": "2026-10-08",
"short_description": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 8.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "apache-struts",
"title_en": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.",
"epss_score": 0.93352
},
{
"digest_date": "2026-10-09",
"key": "CVE-2021-3199",
"cve_id": "CVE-2021-3199",
"vendor_project": "ONLYOFFICE",
"product": "Docs",
"vulnerability_name": "ONLYOFFICE Docs Server Path Traversal Vulnerability",
"date_added": "2026-10-08",
"short_description": "ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-10-09",
"key": "CVE-2023-22894",
"cve_id": "CVE-2023-22894",
"vendor_project": "Strapi",
"product": "Strapi",
"vulnerability_name": "Strapi Cleartext Storage of Sensitive Information Vulnerability",
"date_added": "2026-10-08",
"short_description": "Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-10-10",
"key": "typo3:10",
"product": "typo3",
"category": "cms",
"cycle": "10",
"latest": "10.4.61",
"release_date": "2019-07-23",
"latest_release_date": "2026-10-09",
"eol_date": "2023-04-30",
"support_date": "2021-10-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:11",
"product": "typo3",
"category": "cms",
"cycle": "11",
"latest": "11.5.55",
"release_date": "2020-12-22",
"latest_release_date": "2026-10-09",
"eol_date": "2024-10-31",
"support_date": "2023-03-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:12",
"product": "typo3",
"category": "cms",
"cycle": "12",
"latest": "12.4.50",
"release_date": "2022-10-04",
"latest_release_date": "2026-10-09",
"eol_date": "2026-04-30",
"support_date": "2024-10-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:13",
"product": "typo3",
"category": "cms",
"cycle": "13",
"latest": "13.4.36",
"release_date": "2024-01-30",
"latest_release_date": "2026-10-09",
"eol_date": "2027-12-31",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:14",
"product": "typo3",
"category": "cms",
"cycle": "14",
"latest": "14.3.8",
"release_date": "2025-11-25",
"latest_release_date": "2026-10-09",
"eol_date": "2029-06-30",
"support_date": "2027-12-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-09",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.11.1",
"release_date": "2026-05-05",
"latest_release_date": "2026-10-08",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 189,
"critical": 18,
"high": 104,
"medium": 60,
"low": 7,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2015-0278",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2023-32002",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-07",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.585",
"release_date": "2016-04-20",
"latest_release_date": "2026-10-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 279,
"critical": 19,
"high": 65,
"medium": 181,
"low": 14,
"kev": 4,
"top_cves": [
{
"cve_id": "CVE-2017-1000353",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2016-0791",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2024-23897",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
}
]
}