🔴 最新のCRITICAL (8件)
CISAが新たに「実際に悪用されている」と認定した脆弱性です。最優先で対応してください。
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
📅 2026-10-30 ⏰ 期限:2026-11-13
🔗 対策を確認する(CISA)Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
📅 2026-10-30 ⏰ 期限:2026-11-02
🔗 対策を確認する(CISA)GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
📅 2026-10-29 ⏰ 期限:2026-11-01
🔗 対策を確認する(CISA)Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
📅 2026-10-29 ⏰ 期限:2026-11-01
🔗 対策を確認する(CISA)Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
📅 2026-10-28 ⏰ 期限:2026-11-11
🔗 対策を確認する(CISA)Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
📅 2026-10-28 ⏰ 期限:2026-10-31
🔗 対策を確認する(CISA)Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
📅 2026-10-27 ⏰ 期限:2026-11-10
🔗 対策を確認する(CISA)Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
📅 2026-10-27 ⏰ 期限:2026-11-10
🔗 対策を確認する(CISA)🟠 JPCERT/CC:日本向け注意喚起
🟡 JVN iPedia:国内製品脆弱性情報
取得できませんでした
⚠️ 免責事項
本情報はCISA KEV・JPCERT/CC・JVN iPediaの公開情報を収集・整理したものです。実際の対応は各情報源および専門家への相談のうえ行ってください。
一次情報源: CISA KEV / JPCERT/CC / JVN iPedia