📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 4
|
更新ソフト 2
|
対象期間 7日
|
生成 2026-10-20 11:00:37
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| laravel | 13.37.0 | 2026-10-16 | 19 | 3 | 10 | 1 | ⚠️要確認 |
非主要製品 の更新: 1件（firefox 158.0。OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| — | — | — | — | — | — |
🟠 ★★ 参考 CVE
展開して表示 (4件)
📝 AI 全体サマリ
展開して読む
still_vulnerable=0 なので、最新版では既知 CVE が修正済みの可能性が高いです。Laravel を運用しているサービスがあれば、現在のバージョンを棚卸しして、12系以前や 13 系の古いマイナー版が残っていないか確認することをおすすめします。リリースノートとセキュリティアドバイザリは公式で確認してください。- Fortinet の件は CVSS が低めですが、社内 VPN で FortiGate を使っている可能性があるため、念のため担当部署に共有したほうがよさそうです。
- Firefox 158 系は 2026-10-27 にサポートが切れる予定です。端末管理の担当にも、次期バージョンへの自動更新が効いているか確認してもらうとよいかもしれません。
# docker-compose.yml（骨子のみ）
services:
app:
image: php:8.4-fpm
working_dir: /var/www/html
volumes:
- ./src:/var/www/html # composer create-project laravel/laravel src "13.37.*"
depends_on: [db]
web:
image: nginx:stable
ports: ["8080:80"]
volumes:
- ./src:/var/www/html:ro
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
depends_on: [app]
db:
image: postgres:17
environment:
POSTGRES_DB: laravel
POSTGRES_USER: laravel
POSTGRES_PASSWORD: change-me
- 旧バージョン（例: 運用中のバージョン）と 13.37.0 を別々のコンテナに立て、composer audit の結果やファイルアップロード検証の挙動を比べると確認しやすいです。
- 検証は隔離ネットワーク内に限ってください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-14",
"to": "2026-10-20",
"days": 7
},
"summary": {
"total_kev_new": 4,
"total_software_update": 2,
"by_date": {
"2026-10-17": {
"kev_new": 2,
"software_update": 1
},
"2026-10-16": {
"kev_new": 1,
"software_update": 0
},
"2026-10-14": {
"kev_new": 1,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-10-17",
"key": "CVE-2025-61624",
"cve_id": "CVE-2025-61624",
"vendor_project": "Fortinet",
"product": "Multiple Products",
"vulnerability_name": "Fortinet Multiple Products Path Traversal Vulnerability",
"date_added": "2026-10-16",
"short_description": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-19",
"known_ransomware": "Unknown",
"cvss_score": 6.0,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"attack_vector": "L",
"is_remote": false,
"is_major_product": false,
"matched_product": null,
"title_en": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy",
"epss_score": 0.0058
},
{
"digest_date": "2026-10-17",
"key": "CVE-2026-102764",
"cve_id": "CVE-2026-102764",
"vendor_project": "BeyondTrust",
"product": "Remote Support",
"vulnerability_name": "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability",
"date_added": "2026-10-16",
"short_description": "BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-19",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.",
"epss_score": 0.00601
},
{
"digest_date": "2026-10-16",
"key": "CVE-2026-21589",
"cve_id": "CVE-2026-21589",
"vendor_project": "Atlassian",
"product": "Multiple Products",
"vulnerability_name": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
"date_added": "2026-10-15",
"short_description": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-18",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate",
"epss_score": 0.02777
},
{
"digest_date": "2026-10-14",
"key": "CVE-2026-104935",
"cve_id": "CVE-2026-104935",
"vendor_project": "Ivanti",
"product": "Connect Secure",
"vulnerability_name": "Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability",
"date_added": "2026-10-13",
"short_description": "Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-16",
"known_ransomware": "Unknown",
"cvss_score": 8.6,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.",
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-10-17",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.37.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-10-16",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 19,
"critical": 3,
"high": 10,
"medium": 6,
"low": 0,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-27515",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-43617",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-28254",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-14",
"key": "firefox:158",
"product": "firefox",
"category": "browser",
"cycle": "158",
"latest": "158.0",
"release_date": "2026-10-13",
"latest_release_date": "2026-10-13",
"eol_date": "2026-10-27",
"support_date": null,
"is_major_product": false,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
}
]
}