新着セキュリティニュースバックナンバー

直近表示から外れた情報を確認できます。診断結果とは別情報として扱います。

総件数224649件

表示件数50件/ページ

ページ159

2026-07-23

Weekly Report: 複数のZoom製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のZoom製品には、脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

影響: 複数のZoom製品には、脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

2026-07-23

Weekly Report: Drupal coreに複数の脆弱性

Incident Knowledge JPCERT/CC CVE

Drupal coreには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

影響: Drupal coreには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

2026-07-23

Weekly Report: 複数のCisco製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のCisco製品には、脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新、またはホットパッチを適用することで解決します。ただし、Cisco Identity Services EngineおよびCisco ISE Passive Identity Connectorは、2026年9月に正式パッチが提供される予定です。詳細は、開発者が提供する情報を参照してください。

影響: 複数のCisco製品には、脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新、またはホットパッチを適用することで解決します。ただし、Cisco Identity Services EngineおよびCisco ISE Passive Identity Connectorは、2026年9月に正式パッチが提供される予定です。詳細は、開発者が提供する情報を参照してください。

2026-07-23

Weekly Report: 複数のSplunk製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のSplunk製品には、脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

影響: 複数のSplunk製品には、脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

2026-07-23

Weekly Report: VMware Avi Load Balancerに複数の脆弱性

Incident Knowledge JPCERT/CC CVE

VMware Avi Load Balancerには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

影響: VMware Avi Load Balancerには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

2026-07-23

Weekly Report: WordPressにリモートコード実行につながる脆弱性

Incident Knowledge JPCERT/CC EXPLOIT

WordPressには、認証なしでリモートコード実行につながる脆弱性（通称：wp2shell）があります。複数のセキュリティ企業が本脆弱性の悪用を確認しているとのことです。この問題は、当該製品を修正済みのバージョンに更新することで解決します。複数のセキュリティ企業から侵害調査の参考となる情報が公表されています。開発者が提供する情報とあわせて関連文書もご確認ください。

影響: WordPressには、認証なしでリモートコード実行につながる脆弱性（通称：wp2shell）があります。複数のセキュリティ企業が本脆弱性の悪用を確認しているとのことです。この問題は、当該製品を修正済みのバージョンに更新することで解決します。複数のセキュリティ企業から侵害調査の参考となる情報が公表されています。開発者が提供する情報とあわせて関連文書もご確認ください。

2026-07-23

Weekly Report: JPCERT/CCが「APT-C-60による2026年の攻撃」を公開

Incident Knowledge JPCERT/CC EXPOSURE

JPCERT/CCが「APT-C-60による2026年の攻撃」を公開

影響: JPCERT/CCが「APT-C-60による2026年の攻撃」を公開

2026-07-23

Weekly Report: 複数のマイクロソフト製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のマイクロソフト製品に脆弱性

影響: 複数のマイクロソフト製品に脆弱性

2026-07-23

Weekly Report: JPCERT/CCが2026年4月から6月分の「JPCERT/CC 四半期レポート」を公開

Incident Knowledge JPCERT/CC EXPOSURE

JPCERT/CCが2026年4月から6月分の「JPCERT/CC 四半期レポート」を公開

影響: JPCERT/CCが2026年4月から6月分の「JPCERT/CC 四半期レポート」を公開

2026-07-23

Weekly Report: 複数のAdobe製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のAdobe製品に脆弱性

影響: 複数のAdobe製品に脆弱性

2026-07-23

Weekly Report: Firefoxに複数の脆弱性

Incident Knowledge JPCERT/CC CVE

Firefoxに複数の脆弱性

影響: Firefoxに複数の脆弱性

2026-07-23

Weekly Report: 複数のSAP製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のSAP製品に脆弱性

影響: 複数のSAP製品に脆弱性

2026-07-23

Weekly Report: 複数のFortinet製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のFortinet製品に脆弱性

影響: 複数のFortinet製品に脆弱性

2026-07-23

Weekly Report: SonicWallのSMA1000シリーズに複数の脆弱性

Incident Knowledge JPCERT/CC CVE

SonicWallのSMA1000シリーズに複数の脆弱性

影響: SonicWallのSMA1000シリーズに複数の脆弱性

2026-07-23

Weekly Report: 複数のZoom製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のZoom製品に脆弱性

影響: 複数のZoom製品に脆弱性

2026-07-23

Weekly Report: Drupal coreに複数の脆弱性

Incident Knowledge JPCERT/CC CVE

Drupal coreに複数の脆弱性

影響: Drupal coreに複数の脆弱性

2026-07-23

Weekly Report: 複数のCisco製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のCisco製品に脆弱性

影響: 複数のCisco製品に脆弱性

2026-07-23

Weekly Report: 複数のSplunk製品に脆弱性

Incident Knowledge JPCERT/CC CVE

複数のSplunk製品に脆弱性

影響: 複数のSplunk製品に脆弱性

2026-07-23

Weekly Report: VMware Avi Load Balancerに複数の脆弱性

Incident Knowledge JPCERT/CC CVE

VMware Avi Load Balancerに複数の脆弱性

影響: VMware Avi Load Balancerに複数の脆弱性

2026-07-23

Weekly Report: WordPressにリモートコード実行につながる脆弱性

Incident Knowledge JPCERT/CC CVE

WordPressにリモートコード実行につながる脆弱性

影響: WordPressにリモートコード実行につながる脆弱性

2026-07-23

CVE-2026-16632

Threat Intelligence NVD CVE 危険度: high 緊急度: high

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

cna@vuldb.com

2026-07-23

CVE-2026-16631

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The patch is identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8. It is advisable to implement a patch to correct this issue. The project maintainer explains: "I think it's very rare for someone to use this package with untrusted input".

cna@vuldb.com

2026-07-22

CVE-2026-61246

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

2026-07-22

CVE-2026-60455

Threat Intelligence NVD CVE 危険度: high 緊急度: high

2026-07-22

CVE-2026-60439

Threat Intelligence NVD CVE 危険度: high 緊急度: high

2026-07-22

CVE-2026-60373

Threat Intelligence NVD CVE 危険度: high 緊急度: high

2026-07-22

CVE-2026-60372

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

2026-07-22

CVE-2026-60371

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

2026-07-22

CVE-2026-60370

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

2026-07-22

CVE-2026-60369

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

2026-07-22

CVE-2026-60368

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

2026-07-22

CVE-2026-60367

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

2026-07-22

CVE-2026-60366

Threat Intelligence NVD CVE 危険度: high 緊急度: high

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

2026-07-22

CVE-2026-38766

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function

cve@mitre.org

2026-07-22

CVE-2026-38765

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys

cve@mitre.org

2026-07-22

CVE-2026-38763

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to cause a denial of service via the function sub_13828

cve@mitre.org

2026-07-22

CVE-2026-16630

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly and may be used.

cna@vuldb.com

2026-07-22

CVE-2026-16629

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed locally. Upgrading to version 13.0.8 is recommended to address this issue. The name of the patch is 087a7290264cc6fb7154ea8c2552a7b2cb8b33a3. It is advisable to upgrade the affected component.

cna@vuldb.com

2026-07-22

CVE-2026-16628

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. The patch is named 939b045725e065baebc4587b8bccfd56731eed3d. To fix this issue, it is recommended to deploy a patch.

cna@vuldb.com

2026-07-22

CVE-2026-64798

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.

2026-07-22

CVE-2026-64797

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.

2026-07-22

CVE-2026-64796

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

2026-07-22

CVE-2026-64795

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.

2026-07-22

CVE-2026-64794

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.

2026-07-22

CVE-2026-64793

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.

2026-07-22

CVE-2026-64792

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.

2026-07-22

CVE-2026-64791

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.

2026-07-22

CVE-2026-63685

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.

2026-07-22

CVE-2026-63684

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.

2026-07-22

CVE-2026-63683

Threat Intelligence NVD CVE 危険度: medium 緊急度: medium

IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.

前のページ 159ページ目次のページ

新着セキュリティニュース バックナンバー

新着セキュリティニュースバックナンバー