{
  "type": "mamori-intel-bundle",
  "spec_version": "0.1",
  "id": "bundle--b5af8df82a1a91ad5f76b6470abb8c45",
  "created": "2026-10-23T01:44:52.267927+00:00",
  "objects": [
    {
      "type": "advisory",
      "id": "CVE-2026-106931",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability",
      "published": "2026-10-20",
      "due_date": "2026-10-23",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106931"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-96656",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Plex Media Server: Plex Media Server External Control of File Name or Path Vulnerability",
      "published": "2026-10-20",
      "due_date": "2026-10-23",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96656"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-96655",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
      "published": "2026-10-20",
      "due_date": "2026-11-03",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96655"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-96654",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability",
      "published": "2026-10-20",
      "due_date": "2026-10-23",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96654"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-96652",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability",
      "published": "2026-10-20",
      "due_date": "2026-11-03",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96652"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-110936",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability",
      "published": "2026-10-20",
      "due_date": "2026-11-03",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110936"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-102764",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "BeyondTrust Remote Support: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability",
      "published": "2026-10-16",
      "due_date": "2026-10-19",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102764"
    },
    {
      "type": "advisory",
      "id": "CVE-2025-61624",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability",
      "published": "2026-10-16",
      "due_date": "2026-10-19",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61624"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-21589",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability",
      "published": "2026-10-15",
      "due_date": "2026-10-18",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-105134",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability",
      "published": "2026-10-14",
      "due_date": "2026-10-17",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105134"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-76519",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability",
      "published": "2026-10-14",
      "due_date": "2026-10-17",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76519"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-105133",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability",
      "published": "2026-10-14",
      "due_date": "2026-10-17",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105133"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-0322",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability",
      "published": "2026-10-14",
      "due_date": "2026-10-17",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0322"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-104935",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Ivanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability",
      "published": "2026-10-13",
      "due_date": "2026-10-16",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104935"
    },
    {
      "type": "advisory",
      "id": "CVE-2026-96951",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Microsoft Windows: Microsoft Windows Command Injection Vulnerability",
      "published": "2026-10-13",
      "due_date": "2026-10-16",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96951"
    },
    {
      "type": "advisory",
      "id": "CVE-2015-5477",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "ISC BIND:  ISC BIND Data Processing Errors Vulnerability",
      "published": "2026-10-08",
      "due_date": "2026-10-11",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5477"
    },
    {
      "type": "advisory",
      "id": "CVE-2016-3081",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Apache Struts: Apache Struts Command Injection Vulnerability",
      "published": "2026-10-08",
      "due_date": "2026-10-11",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3081"
    },
    {
      "type": "advisory",
      "id": "CVE-2023-22894",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "Strapi Strapi: Strapi Cleartext Storage of Sensitive Information Vulnerability",
      "published": "2026-10-08",
      "due_date": "2026-10-11",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22894"
    },
    {
      "type": "advisory",
      "id": "CVE-2021-3199",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "ONLYOFFICE Docs: ONLYOFFICE Docs Server Path Traversal Vulnerability",
      "published": "2026-10-08",
      "due_date": "2026-10-11",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3199"
    },
    {
      "type": "advisory",
      "id": "CVE-2015-3306",
      "source": "cisa_kev",
      "severity": "exploited-in-the-wild",
      "title": "ProFTPD ProFTPD: ProFTPD Improper Access Control Vulnerability",
      "published": "2026-10-08",
      "due_date": "2026-10-11",
      "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3306"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260033",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (公開)",
      "published": "2026-10-22",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260033.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260032",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "SiteGuard Server EditionにおけるOSコマンドインジェクションの脆弱性（CVE-2026-106931）に関する注意喚起 (公開)",
      "published": "2026-10-14",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260032.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260031",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "2026年10月マイクロソフトセキュリティ更新プログラムに関する注意喚起 (公開)",
      "published": "2026-10-14",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260031.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260030",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "直近で相次いでいる国内組織における不正アクセスに関する注意喚起 (更新)",
      "published": "2026-10-09",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260030.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260029",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "NetScaler ADCおよびNetScaler Gatewayにおける複数の脆弱性（CVE-2026-88771、CVE-2026-88772等）に関する注意喚起 (更新)",
      "published": "2026-10-02",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260029.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260028",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "F5 BIG-IP Access Policy Managerにおけるヒープベースのバッファオーバーフローの脆弱性（CVE-2026-94127）に関する注意喚起 (公開)",
      "published": "2026-09-24",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260028.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260027",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "Cisco Secure Email GatewayにおけるSQLインジェクションの脆弱性（CVE-2026-76461）に関する注意喚起 (公開)",
      "published": "2026-09-15",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260027.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-at260026",
      "source": "jpcert_alert",
      "severity": "alert",
      "title": "Adobe AcrobatおよびReaderの脆弱性（APSB26-141）に関する注意喚起 (公開)",
      "published": "2026-09-09",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/at/2026/at260026.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-weekly-2026-10-21",
      "source": "jpcert",
      "severity": "info",
      "title": "Weekly Report 2026-10-21号",
      "published": "2026-10-21",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/wr/2026/wr261021.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-weekly-2026-10-15",
      "source": "jpcert",
      "severity": "info",
      "title": "Weekly Report 2026-10-15号",
      "published": "2026-10-15",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/wr/2026/wr261015.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-weekly-2026-10-07",
      "source": "jpcert",
      "severity": "info",
      "title": "Weekly Report 2026-10-07号",
      "published": "2026-10-07",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/wr/2026/wr261007.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-weekly-2026-09-30",
      "source": "jpcert",
      "severity": "info",
      "title": "Weekly Report 2026-09-30号",
      "published": "2026-09-30",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/wr/2026/wr260930.html"
    },
    {
      "type": "advisory",
      "id": "jpcert-ics-portal",
      "source": "jpcert_ics",
      "severity": "info",
      "title": "[ICS/OT] JPCERT/CC 制御システムセキュリティ情報（製造業・OT向け）",
      "published": "",
      "due_date": null,
      "required_action": null,
      "url": "https://www.jpcert.or.jp/ics/"
    }
  ]
}