📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 1
|
対象期間 7日
|
生成 2026-10-22 11:00:31
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| laravel | 13.37.0 | 2026-10-16 | 19 | 3 | 10 | 1 | ⚠️要確認 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| — | — | — | — | — | — |
🟠 ★★ 参考 CVE
展開して表示 (3件)
📝 AI 全体サマリ
展開して読む
still_vulnerable=0 なので、最新版では既知の CVE がすべて修正済みの可能性が高いと考えられます。13 系を使っているサービスは、通常のパッチ計画で 13.37.0 へ上げる方針でよいと思われます。12 系以前の環境が残っている場合は、該当する CVE の影響範囲を公式の Security Advisory で確認してください。
# docker-compose.yml（骨子）
services:
app-old:
image: php:8.3-fpm
volumes: ["./app-old:/var/www/html"] # 現行バージョンの Laravel
app-new:
image: php:8.3-fpm
volumes: ["./app-new:/var/www/html"] # 13.37.0 へ更新した版
web:
image: nginx:stable
ports: ["8080:80"]
volumes: ["./nginx.conf:/etc/nginx/conf.d/default.conf:ro"]
depends_on: [app-old, app-new]
db:
image: postgres:16
environment:
POSTGRES_PASSWORD: example
- 確認の観点: composer audit の結果を新旧で比べる、ファイルアップロードのバリデーションの挙動を比べる（CVE-2025-27515 関連）、既存テストスイートで回帰がないかを見る。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-16",
"to": "2026-10-22",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 1,
"by_date": {
"2026-10-17": {
"kev_new": 2,
"software_update": 1
},
"2026-10-16": {
"kev_new": 1,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-10-17",
"key": "CVE-2025-61624",
"cve_id": "CVE-2025-61624",
"vendor_project": "Fortinet",
"product": "Multiple Products",
"vulnerability_name": "Fortinet Multiple Products Path Traversal Vulnerability",
"date_added": "2026-10-16",
"short_description": "FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-19",
"known_ransomware": "Unknown",
"cvss_score": 6.0,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"attack_vector": "L",
"is_remote": false,
"is_major_product": false,
"matched_product": null,
"title_en": "An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy",
"epss_score": 0.0058
},
{
"digest_date": "2026-10-17",
"key": "CVE-2026-102764",
"cve_id": "CVE-2026-102764",
"vendor_project": "BeyondTrust",
"product": "Remote Support",
"vulnerability_name": "BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability",
"date_added": "2026-10-16",
"short_description": "BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-19",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.",
"epss_score": 0.00601
},
{
"digest_date": "2026-10-16",
"key": "CVE-2026-21589",
"cve_id": "CVE-2026-21589",
"vendor_project": "Atlassian",
"product": "Multiple Products",
"vulnerability_name": "Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
"date_added": "2026-10-15",
"short_description": "Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-18",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate",
"epss_score": 0.02777
}
],
"software_update": [
{
"digest_date": "2026-10-17",
"key": "laravel:13",
"product": "laravel",
"category": "framework",
"cycle": "13",
"latest": "13.37.0",
"release_date": "2026-03-17",
"latest_release_date": "2026-10-16",
"eol_date": "2028-03-17",
"support_date": "2027-09-30",
"is_major_product": true,
"cve_stats": {
"total": 19,
"critical": 3,
"high": 10,
"medium": 6,
"low": 0,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2025-27515",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-43617",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-28254",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
}
]
}