📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 5
|
更新ソフト 7
|
対象期間 7日
|
生成 2026-10-12 15:42:55
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| TYPO3 (14系) | 14.3.8 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (13系) | 13.4.36 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (12系) | 12.4.50 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (11系) | 11.5.55 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| TYPO3 (10系) | 10.4.61 | 2026-10-09 | 217 | 2 | 42 | 0 | ⚠️要確認 |
| Node.js (26系) | 26.11.1 | 2026-10-08 | 189 | 18 | 104 | 1 | ⚠️要確認 |
| Jenkins (2系) | 2.585 | 2026-10-06 | 279 | 19 | 65 | 4 | ⚠️要確認 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD (mod_copy) | 10.0 | ✓ | N | パッチ即時 |
| CVE-2016-3081 | Apache Struts 2 | 8.1 | ✓ | N | パッチ即時 |
| CVE-2015-5477 | ISC BIND | 7.8 | ✓ | N | パッチ即時 |
🟠 ★★ 参考 CVE
展開して表示 (2件)
📝 AI 全体サマリ
展開して読む
mod_copy が有効だと、認証なしでファイル操作が可能になる可能性があります。EPSS も 0.97 と非常に高い値です。パッチをすぐ当てられない場合は mod_copy の無効化が緩和策になり得ます（公式アドバイザリで確認）。struts2-core のバージョンを確認してください。脆弱性検証環境の構築 プロジェクトの手順に沿って、外部と通信できない隔離ネットワーク上に脆弱版と修正版を並べたコンテナを立て、バージョン差分と緩和設定（mod_copy 無効化）の効果を比較する、という構成が考えられます。具体的な攻撃手順・exploit コードは本サマリには含めません。公開されている検証手順やベンダー公式情報を参照してください。原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-06",
"to": "2026-10-12",
"days": 7
},
"summary": {
"total_kev_new": 5,
"total_software_update": 7,
"by_date": {
"2026-10-10": {
"kev_new": 0,
"software_update": 5
},
"2026-10-09": {
"kev_new": 5,
"software_update": 1
},
"2026-10-07": {
"kev_new": 0,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-10-09",
"key": "CVE-2015-3306",
"cve_id": "CVE-2015-3306",
"vendor_project": "ProFTPD",
"product": "ProFTPD",
"vulnerability_name": "ProFTPD Improper Access Control Vulnerability",
"date_added": "2026-10-08",
"short_description": "ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "proftpd",
"title_en": "The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.",
"epss_score": 0.96752
},
{
"digest_date": "2026-10-09",
"key": "CVE-2015-5477",
"cve_id": "CVE-2015-5477",
"vendor_project": "ISC",
"product": "BIND",
"vulnerability_name": " ISC BIND Data Processing Errors Vulnerability",
"date_added": "2026-10-08",
"short_description": "ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 7.8,
"cvss_severity": "HIGH",
"cvss_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "bind",
"title_en": "named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.",
"epss_score": 0.91284
},
{
"digest_date": "2026-10-09",
"key": "CVE-2016-3081",
"cve_id": "CVE-2016-3081",
"vendor_project": "Apache",
"product": "Struts",
"vulnerability_name": "Apache Struts Command Injection Vulnerability",
"date_added": "2026-10-08",
"short_description": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": 8.1,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": true,
"matched_product": "apache-struts",
"title_en": "Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.",
"epss_score": 0.93352
},
{
"digest_date": "2026-10-09",
"key": "CVE-2021-3199",
"cve_id": "CVE-2021-3199",
"vendor_project": "ONLYOFFICE",
"product": "Docs",
"vulnerability_name": "ONLYOFFICE Docs Server Path Traversal Vulnerability",
"date_added": "2026-10-08",
"short_description": "ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-10-09",
"key": "CVE-2023-22894",
"cve_id": "CVE-2023-22894",
"vendor_project": "Strapi",
"product": "Strapi",
"vulnerability_name": "Strapi Cleartext Storage of Sensitive Information Vulnerability",
"date_added": "2026-10-08",
"short_description": "Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-11",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-10-10",
"key": "typo3:10",
"product": "typo3",
"category": "cms",
"cycle": "10",
"latest": "10.4.61",
"release_date": "2019-07-23",
"latest_release_date": "2026-10-09",
"eol_date": "2023-04-30",
"support_date": "2021-10-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:11",
"product": "typo3",
"category": "cms",
"cycle": "11",
"latest": "11.5.55",
"release_date": "2020-12-22",
"latest_release_date": "2026-10-09",
"eol_date": "2024-10-31",
"support_date": "2023-03-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:12",
"product": "typo3",
"category": "cms",
"cycle": "12",
"latest": "12.4.50",
"release_date": "2022-10-04",
"latest_release_date": "2026-10-09",
"eol_date": "2026-04-30",
"support_date": "2024-10-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:13",
"product": "typo3",
"category": "cms",
"cycle": "13",
"latest": "13.4.36",
"release_date": "2024-01-30",
"latest_release_date": "2026-10-09",
"eol_date": "2027-12-31",
"support_date": "2026-06-30",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-10",
"key": "typo3:14",
"product": "typo3",
"category": "cms",
"cycle": "14",
"latest": "14.3.8",
"release_date": "2025-11-25",
"latest_release_date": "2026-10-09",
"eol_date": "2029-06-30",
"support_date": "2027-12-31",
"is_major_product": true,
"cve_stats": {
"total": 217,
"critical": 2,
"high": 42,
"medium": 146,
"low": 27,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2009-0258",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2011-3583",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2011-4628",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-09",
"key": "nodejs:26",
"product": "nodejs",
"category": "programming",
"cycle": "26",
"latest": "26.11.1",
"release_date": "2026-05-05",
"latest_release_date": "2026-10-08",
"eol_date": "2029-04-30",
"support_date": "2027-10-27",
"is_major_product": true,
"cve_stats": {
"total": 189,
"critical": 18,
"high": 104,
"medium": 60,
"low": 7,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-21636",
"severity": "CRITICAL",
"score": 10.0
},
{
"cve_id": "CVE-2015-0278",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2023-32002",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-07",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.585",
"release_date": "2016-04-20",
"latest_release_date": "2026-10-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 279,
"critical": 19,
"high": 65,
"medium": 181,
"low": 14,
"kev": 4,
"top_cves": [
{
"cve_id": "CVE-2017-1000353",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2016-0791",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2024-23897",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
}
]
}