In secure network coding, there is a possibility that the eavesdropper can improve her performance when she changes (contaminates) the information on the attacked edges (active attack) and chooses the attacked edges adaptively (adaptive attack). We analyze the security for network code over such types of attacks. We show that active and adaptive attacks cannot improve the performance of the eavesdropper when the code is linear. Further, we give a non-linear example, in which an adaptive attack improves the performance of the eavesdropper. We derive the capacity for the unicast case and the capacity region for the multicast case or the multiple multicast case in several examples of relay networks, beyond the minimum cut theorem, when no additional random number is allowed as scramble variables in the intermediate nodes. No prior study compared the difference of the capacity and the capacity region between the existence and the non-existence of randomness in the intermediate nodes under these network models even with non-adaptive and non-active attacks.