📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 1
|
対象期間 7日
|
生成 2026-10-21 11:00:30
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| laravel | 13.37.0 | 2026-10-16 | 19 | 3 | 10 | 1 | ⚠️要確認 |
非主要製品の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（今週 KEV に新しく追加された 3 件は、すべて PRODUCTS 辞書に登録されていない製品です。そのため★★★の条件「主要製品であること」を満たしません。）
🟠 ★★ 参考 CVE
展開して表示 (3件)
📝 AI 全体サマリ
展開して読む
still_vulnerable=0 です。最新版に更新すれば、既知の CVE の影響は受けない状態になる可能性が高いと考えられます。KEV 1 件がどの CVE かは今回のデータに含まれていないため、SecuPortal 上で確認することを推奨します。Laravel を使っているサービスがあれば、マイナー更新として計画的に適用するのが妥当と思われます。- BeyondTrust Remote Support は CVSS 9.8 かつネットワーク経由の攻撃で、過去にも同製品の脆弱性が実際の攻撃に使われた事例があります。取引先や委託先経由で影響を受けるリスクは念頭に置いておくとよいかもしれません。
- CVE-2026-21589 は CVSS がまだ算出されていません。今後スコアが付いた時点で改めて確認することを推奨します。
```yaml
# docker-compose.yml（骨子のみ。検証コードは公式アドバイザリの記述範囲で別途作成）
services:
laravel-old:
image: php:8.3-cli
working_dir: /app
volumes: ["./app-old:/app"] # 影響バージョンを composer で固定
command: php artisan serve --host=0.0.0.0 --port=8000
ports: ["8001:8000"]
laravel-new:
image: php:8.3-cli
working_dir: /app
volumes: ["./app-new:/app"] # laravel/framework 13.37.0
command: php artisan serve --host=0.0.0.0 --port=8000
ports: ["8002:8000"]
networks:
default:
internal: true # 検証環境は外部ネットワークから隔離
```
自社コードで files.* のようなワイルドカードを使ったバリデーションルールがあるかを先に grep で洗い出しておくと、影響範囲を絞り込みやすくなります。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-15",
"to": "2026-10-21",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 1,
"by_date": {
"2026-10-17": {
"kev_new": 2,
"software_update": 1
},
"2026-10-16": {
"kev_new": 1,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-10-17",
"key": "CVE-2025-61624",
"cve_id": "CVE-2025-61624",
"vendor_project": "Fortinet",
"product": "Multiple Products",
"vulnerability_name": "Fortinet Multiple Products Path Traversal Vulnerability",
"date_added": "2026-10-16",
"short_description": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-19",
"known_ransomware": "Unknown",
"cvss_score": 6.0,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"attack_vector": "L",
"is_remote": false,
"is_major_product": false,
"matched_product": null,
"title_en": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy",
"epss_score": 0.0058
},
{
"digest_date": "2026-10-17",
"key": "CVE-2026-102764",
"cve_id": "CVE-2026-102764",
"vendor_project": "BeyondTrust",
"product": "Remote Support",
"vulnerability_name": "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability",
"date_added": "2026-10-16",
"short_description": "BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-19",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.",
"epss_score": 0.00601
},
{
"digest_date": "2026-10-16",
"key": "CVE-2026-21589",
"cve_id": "CVE-2026-21589",
"vendor_project": "Atlassian",
"product": "Multiple Products",
"vulnerability_name": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
"date_added": "2026-10-15",
"short_description": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-18",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate",
"epss_score": 0.02777
}
],
"software_update": [
{
"digest_date": "2026-10-17",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.37.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-10-16",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 19,
"critical": 3,
"high": 10,
"medium": 6,
"low": 0,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-27515",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-43617",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-28254",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
}
]
}