{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-96903", "aliases": [], "title": "Easy Property Listings：脆弱性情報", "summary": "Easy Property Listingsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Easy Property Listings", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Easy Property Listings", "range": "< 3.5.27" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96903", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/52b63cac-2730-4395-bf68-3a55aceb0e14/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-20T06:16:58.190Z", "modifiedAt": "2026-10-20T19:29:37.220Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.", "sourceTitle": "CVE-2026-96903", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Easy Property Listings", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "3.5.27", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-20T19:29:37.220Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "state": "published" } ] }, { "id": "CVE-2026-96902", "aliases": [], "title": "Easy Property Listings：脆弱性情報", "summary": "Easy Property Listingsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Easy Property Listings", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Easy Property Listings", "range": "< 3.5.28" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96902", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/b89e410b-982d-44e0-850d-8325a51db365/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-20T06:16:58.073Z", "modifiedAt": "2026-10-20T19:29:37.220Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.", "sourceTitle": "CVE-2026-96902", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Easy Property Listings", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "3.5.28", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-20T19:29:37.220Z", "fetchedAt": "2026-10-22T22:09:50.314Z", "state": "published" } ] }, { "id": "CVE-2026-93300", "aliases": [], "title": "EventON - Subscriber：データベースへの不正操作", "summary": "EventON - Subscriberにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "product": "EventON - Subscriber", "category": "wordpress", "component": "plugin", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "EventON - Subscriber", "range": "<= 1.4.5" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93300", "label": "NVDの原文" }, { "url": "https://myeventon.com/", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6b6b32-bcde-4c40-a954-c5c62eb3436e?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-20T06:16:57.913Z", "modifiedAt": "2026-10-20T19:27:34.430Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", "sourceTitle": "CVE-2026-93300", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "EventOn", "product": "EventON - Subscriber", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThanOrEqual": "1.4.5", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-20T19:27:34.430Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "JVN88864366", "aliases": [], "title": "アツミ電氣製DVRに利用可能な非公開機能を悪用される問題", "summary": "アツミ電氣株式会社が提供する複数のDVR（Digital Video Recorder）には、非公開機能を悪用される問題が存在しています。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "アツミ電氣製DVRに利用可能な非公開機能を悪用される問題", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN88864366/", "label": "JVNの原文" } ], "publishedAt": "2026-10-20T05:00:00.000Z", "modifiedAt": "2026-10-20T05:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "アツミ電氣株式会社が提供する複数のDVR（Digital Video Recorder）には、非公開機能を悪用される問題が存在しています。", "sourceTitle": "アツミ電氣製DVRに利用可能な非公開機能を悪用される問題", "summaryMethod": "JVN掲載の日本語概要。複数のCVEを含む記事は一括情報です。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-20T05:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "JVN33436631", "aliases": [], "title": "複数のLenovo製タブレットのAndroid Verified Boot機能において既知のテスト用鍵がそのまま使用されている問題", "summary": "Lenovoが提供する複数のタブレットのAVB（Android Verified Boot）機能では、AOSP（Android Open Source Project）で公開されているテスト用の鍵をそのまま使用しています。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "複数のLenovo製タブレットのAndroid Verified Boot機能において既知のテスト用鍵がそのまま使用されている問題", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN33436631/", "label": "JVNの原文" } ], "publishedAt": "2026-10-20T03:00:15.000Z", "modifiedAt": "2026-10-20T03:00:15.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "Lenovoが提供する複数のタブレットのAVB（Android Verified Boot）機能では、AOSP（Android Open Source Project）で公開されているテスト用の鍵をそのまま使用しています。", "sourceTitle": "複数のLenovo製タブレットのAndroid Verified Boot機能において既知のテスト用鍵がそのまま使用されている問題", "summaryMethod": "JVN掲載の日本語概要。複数のCVEを含む記事は一括情報です。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-20T03:00:15.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "JVN29783594", "aliases": [], "title": "UnRTFにおける境界外書き込みの脆弱性", "summary": "GNU Projectが提供するUnRTFには境界外書き込みの脆弱性が存在します。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "UnRTF", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN29783594/", "label": "JVNの原文" } ], "publishedAt": "2026-10-20T03:00:00.000Z", "modifiedAt": "2026-10-20T03:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "unknown", "sources": [ "JVN" ], "originalText": "GNU Projectが提供するUnRTFには境界外書き込みの脆弱性が存在します。", "sourceTitle": "UnRTFにおける境界外書き込みの脆弱性", "summaryMethod": "JVN掲載の日本語概要。複数のCVEを含む記事は一括情報です。", "state": "published", "sourceSnapshots": [ { "source": "JVN", "modifiedAt": "2026-10-20T03:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-106931", "aliases": [], "title": "EG Secure Solutions SiteGuard Server Edition：コード実行", "summary": "EG Secure Solutions SiteGuard Server Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "product": "EG Secure Solutions SiteGuard Server Edition", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "実際の悪用が確認されています。まず利用中の製品と対象条件を照合してください。", "公式の修正・緩和策を優先して確認し、更新計画を進めてください。", "影響を受ける環境は、管理者とともに不正アクセスの痕跡も確認してください。" ], "references": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-106931", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.eg-secure.co.jp/siteguard/news/alert-202610-1", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106931", "label": "CISAが示す関連情報" } ], "publishedAt": "2026-10-20T00:00:00.000Z", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "confirmed", "sources": [ "CISA KEV" ], "originalText": "EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.", "sourceTitle": "EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSnapshots": [ { "source": "CISA KEV", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-110936", "aliases": [], "title": "Siemens Software Center：コード実行", "summary": "Siemens Software Centerにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "product": "Siemens Software Center", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "実際の悪用が確認されています。まず利用中の製品と対象条件を照合してください。", "公式の修正・緩和策を優先して確認し、更新計画を進めてください。", "影響を受ける環境は、管理者とともに不正アクセスの痕跡も確認してください。" ], "references": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-110936", "label": "CISA KEV（悪用確認）" }, { "url": "https://productcert.siemens.com/productcert/html/ssa-580366.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110936", "label": "CISAが示す関連情報" } ], "publishedAt": "2026-10-20T00:00:00.000Z", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "confirmed", "sources": [ "CISA KEV" ], "originalText": "Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.", "sourceTitle": "Siemens Software Center Uncontrolled Search Path Element Vulnerability", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSnapshots": [ { "source": "CISA KEV", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-96652", "aliases": [], "title": "Plex Media Server：脆弱性情報", "summary": "Plex Media Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Plex Media Server", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "実際の悪用が確認されています。まず利用中の製品と対象条件を照合してください。", "公式の修正・緩和策を優先して確認し、更新計画を進めてください。", "影響を受ける環境は、管理者とともに不正アクセスの痕跡も確認してください。" ], "references": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652", "label": "CISA KEV（悪用確認）" }, { "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96652", "label": "CISAが示す関連情報" } ], "publishedAt": "2026-10-20T00:00:00.000Z", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "confirmed", "sources": [ "CISA KEV" ], "originalText": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.", "sourceTitle": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSnapshots": [ { "source": "CISA KEV", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-96654", "aliases": [], "title": "Plex Media Server：脆弱性情報", "summary": "Plex Media Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Plex Media Server", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "実際の悪用が確認されています。まず利用中の製品と対象条件を照合してください。", "公式の修正・緩和策を優先して確認し、更新計画を進めてください。", "影響を受ける環境は、管理者とともに不正アクセスの痕跡も確認してください。" ], "references": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96654", "label": "CISA KEV（悪用確認）" }, { "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96654", "label": "CISAが示す関連情報" } ], "publishedAt": "2026-10-20T00:00:00.000Z", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "confirmed", "sources": [ "CISA KEV" ], "originalText": "Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.", "sourceTitle": "Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSnapshots": [ { "source": "CISA KEV", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-96655", "aliases": [], "title": "Plex Media Server：脆弱性情報", "summary": "Plex Media Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Plex Media Server", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "実際の悪用が確認されています。まず利用中の製品と対象条件を照合してください。", "公式の修正・緩和策を優先して確認し、更新計画を進めてください。", "影響を受ける環境は、管理者とともに不正アクセスの痕跡も確認してください。" ], "references": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96655", "label": "CISA KEV（悪用確認）" }, { "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96655", "label": "CISAが示す関連情報" } ], "publishedAt": "2026-10-20T00:00:00.000Z", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "confirmed", "sources": [ "CISA KEV" ], "originalText": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.", "sourceTitle": "Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSnapshots": [ { "source": "CISA KEV", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-96656", "aliases": [], "title": "Plex Media Server：脆弱性情報", "summary": "Plex Media Serverに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Plex Media Server", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": null, "cvssVector": null, "affected": [], "fixed": [], "steps": [ "実際の悪用が確認されています。まず利用中の製品と対象条件を照合してください。", "公式の修正・緩和策を優先して確認し、更新計画を進めてください。", "影響を受ける環境は、管理者とともに不正アクセスの痕跡も確認してください。" ], "references": [ { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96656", "label": "CISA KEV（悪用確認）" }, { "url": "https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96656", "label": "CISAが示す関連情報" } ], "publishedAt": "2026-10-20T00:00:00.000Z", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "exploitStatus": "confirmed", "sources": [ "CISA KEV" ], "originalText": "Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.", "sourceTitle": "Plex Media Server External Control of File Name or Path Vulnerability", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSnapshots": [ { "source": "CISA KEV", "modifiedAt": "2026-10-20T00:00:00.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ] }, { "id": "CVE-2026-111862", "aliases": [], "title": "Rank Math SEO PRO：脆弱性情報", "summary": "Rank Math SEO PROに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Rank Math SEO PRO", "category": "wordpress", "component": "plugin", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "security@wordfence.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Rank Math SEO PRO", "range": "3.0.123" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111862", "label": "NVDの原文" }, { "url": "https://rankmath.com/changelog/", "label": "security@wordfence.com" }, { "url": "https://rankmath.com/kb/pro-3-0-123-security-incident/", "label": "security@wordfence.com" }, { "url": "https://rdap.verisign.com/com/v1/domain/rank1cdn.com", "label": "security@wordfence.com" }, { "url": "https://urlscan.io/result/01a145c2-8dc8-72ff-a65d-21209ca29c4f/", "label": "security@wordfence.com" }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f?source=cve", "label": "security@wordfence.com" } ], "publishedAt": "2026-10-19T17:17:04.507Z", "modifiedAt": "2026-10-20T15:17:13.573Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.", "sourceTitle": "CVE-2026-111862", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "RankMath", "product": "Rank Math SEO PRO", "defaultStatus": "unaffected", "versions": [ { "version": "3.0.123", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-20T15:17:13.573Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-112329", "aliases": [], "title": "Sensei LMS：脆弱性情報", "summary": "Sensei LMSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Sensei LMS", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "4.0", "cvssSource": "disclosure@vulncheck.com", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "affected": [ { "product": "Sensei LMS", "range": "< 4.26.4" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112329", "label": "NVDの原文" }, { "url": "https://senseilms.com/release-notes/", "label": "disclosure@vulncheck.com" }, { "url": "https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-save-new-message", "label": "disclosure@vulncheck.com" } ], "publishedAt": "2026-10-19T15:17:06.420Z", "modifiedAt": "2026-10-22T03:16:37.673Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.", "sourceTitle": "CVE-2026-112329", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Automattic", "product": "Sensei LMS", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "4.26.4", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-22T03:16:37.673Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-112328", "aliases": [], "title": "Sensei LMS：脆弱性情報", "summary": "Sensei LMSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Sensei LMS", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "4.0", "cvssSource": "disclosure@vulncheck.com", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "affected": [ { "product": "Sensei LMS", "range": "< 4.26.4" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112328", "label": "NVDの原文" }, { "url": "https://senseilms.com/release-notes/", "label": "disclosure@vulncheck.com" }, { "url": "https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-add-new-module-term-ajax", "label": "disclosure@vulncheck.com" } ], "publishedAt": "2026-10-19T15:17:06.280Z", "modifiedAt": "2026-10-19T21:14:14.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.", "sourceTitle": "CVE-2026-112328", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Automattic", "product": "Sensei LMS", "defaultStatus": "unaffected", "versions": [ { "version": "0", "lessThan": "4.26.4", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:14:14.150Z", "fetchedAt": "2026-10-22T22:09:30.689Z", "state": "published" } ] }, { "id": "CVE-2026-94294", "aliases": [], "title": "App Builder：脆弱性情報", "summary": "App Builderに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "App Builder", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "App Builder", "range": ">= 3.8.4 / < 5.7.1" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94294", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/26ac49f1-657b-49ab-937b-1ceabde1e891/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.950Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.", "sourceTitle": "CVE-2026-94294", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "App Builder", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "3.8.4", "lessThan": "5.7.1", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94272", "aliases": [], "title": "Snap Finance：脆弱性情報", "summary": "Snap Financeに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "Snap Finance", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "Snap Finance", "range": ">= 1.0.8 / < 3.12.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94272", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/e3a4931a-3678-46ac-9ad0-3cc6a1ed5d90/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.830Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.", "sourceTitle": "CVE-2026-94272", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "Snap Finance", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.0.8", "lessThan": "3.12.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94231", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94231", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/d90ad3f4-4d58-43bc-8f17-0f6b8dfdde4f/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.710Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.", "sourceTitle": "CVE-2026-94231", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94230", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94230", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/05881cde-313e-47d5-a176-2b0b0051bca9/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.580Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.", "sourceTitle": "CVE-2026-94230", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] }, { "id": "CVE-2026-94229", "aliases": [], "title": "TrueBooker：脆弱性情報", "summary": "TrueBookerに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "risk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "product": "TrueBooker", "category": "wordpress", "component": "plugin", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "contact@wpscan.com", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "TrueBooker", "range": ">= 1.1.9 / < 1.3.0" } ], "fixed": [], "steps": [ "使っている製品名・バージョン・構成を、影響を受ける条件と照合してください。", "修正版や回避策は原文で確認してください。影響範囲の上限から修正版を推測しないでください。", "更新後は稼働中のバージョンと動作を確認してください。管理を委託している場合は、提供元に対応状況を確認してください。" ], "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94229", "label": "NVDの原文" }, { "url": "https://wpscan.com/vulnerability/6041298d-1e66-4fba-9cc1-7b55e591ffaf/", "label": "contact@wpscan.com" } ], "publishedAt": "2026-10-19T07:16:32.450Z", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "exploitStatus": "unknown", "sources": [ "NVD" ], "originalText": "The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.", "sourceTitle": "CVE-2026-94229", "summaryMethod": "原文の語句に基づく定型要約。条件や例外は原文を確認してください。", "state": "published", "affectedDetails": [ { "vendor": "Unknown", "product": "TrueBooker", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "versions": [ { "version": "1.1.9", "lessThan": "1.3.0", "versionType": "semver", "status": "affected" } ] } ], "sourceSnapshots": [ { "source": "NVD", "modifiedAt": "2026-10-19T21:02:51.987Z", "fetchedAt": "2026-10-22T22:09:42.384Z", "state": "published" } ] } ], "total": 2160, "limit": 20, "offset": 100, "filters": { "product": "all", "type": "all", "q": "", "page": 6 }, "pagination": { "page": 6, "pageSize": 20, "totalPages": 108 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 11, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-22T21:17:13.942Z 〜 2026-10-22T22:18:00.744Z、全製品の変更 373/373件まで確認、対象11件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-22T22:18:00.744Z", "lastAttempt": "2026-10-22T22:18:00.744Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }