VulnPulse

脆弱性・アップデート

2 ページ目

10月17日(土)

  • 緊急04:44脆弱性アドバイザリAnthropic (Claude)PythonGitHub Advisory Database

    Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

    影響: pip:claude-agent-sdk < 0.2.121 → 0.2.121 The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume. Users are advised to update to…

    CVE-2026-96620
  • 注意04:17脆弱性アドバイザリPythonGitHub Advisory Database

    ClickMigrate has Path Traversal in "revision -m" argument

    影響: pip:ClickMigrate < 1.0.3 → 1.0.3 A path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwar…

    CVE-2026-68549

10月16日(金)

  • 警告05:22脆弱性アドバイザリPythonGitHub Advisory Database

    Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

    影響: pip:pipecat-ai >= 0.0.98, <= 1.5.0 → 1.6.0 Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is not built or supported as a production server. Exploitation therefore requires an operator to deliberately make the development runner reachable from an untrusted network, such as by setting --host 0.0…

    CVE-2026-102682
  • 警告05:22脆弱性アドバイザリPythonGitHub Advisory Database

    JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

    影響: pip:jupyterlab >= 4.6.0, <= 4.6.3 → 4.6.4, pip:jupyterlab >= 4.5.7, <= 4.5.10 → 4.5.11, pip:notebook >= 7.5.6, <= 7.6.2 → 7.6.3, pip:jupyterlite-core >= 0.7.5, <= 0.8.3 → 0.8.4 A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they click. Both trust commands read whichever document is current at that moment: markdownviewer:trust uses…

    CVE-2026-102832

10月13日(火)

10月9日(金)

10月8日(木)

  • 20:00リリース・告知DjangoPythonDjango Weblog

    Django security reporting update

    We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies . Security issues should be reported by emailing security@djangoproject.com

10月6日(火)

  • 22:00リリース・告知DjangoPythonDjango Weblog

    Django security releases issued: 6.1.2, 6.0.9, and 5.2.18

    In accordance with our security release policy , the Django team is issuing releases for Django 6.1.2 , Django 6.0.9 , and Django 5.2.18 . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very long language codes. Language codes were used as keys in an in-memory cache before their length…

    CVE-2026-77050

10月2日(金)

10月1日(木)

  • 22:51リリース・告知DjangoPythonDjango Weblog

    Nominate Someone for the 2026 Malcolm Tredinnick Memorial Prize

    Hello Everyone 👋 It is that time of year again when we recognize someone from our community in memory of our friend Malcolm. Malcolm was an early core contributor to Django and had a huge influence on the Django we know today. Besides being knowledgeable, he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day. The prize Our prizes page summarizes it nicely: The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Mal…

  • 09:00リリース・告知PythonPython Insider

    Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available!

    Security updates across Python 3.10–3.14, the final maintenance release of 3.13, and a farewell to Python 3.10.

9月30日(水)

9月26日(土)

9月24日(木)

  • 23:13リリース・告知DjangoGitHubPythonDjango Weblog

    DSF member of the month - Ken Whitesell

    For September 2026, we welcome Ken Whitesell as our DSF member of the month! ⭐ Ken has long been part of the Django community, serving for many years as an helper in the Django forum and recipient of the Malcolm Tredinnick Memorial award. He has been a volunteer for DjangoCon US for over ten years. He is a DSF member since September 2017! You can learn more about Ken by visiting Ken's blog and his GitHub Profile . Let’s spend some time getting to know Ken better! Can you tell us a little about yourself? (hobbies, education, etc) Hi everyone! I've been retired for a little more than a year now…

9月23日(水)

9月22日(火)

  • 20:00リリース・告知DjangoPythonDjango Weblog

    New Technical Governance Approved

    Both the Steering Council and DSF Board have approved DEP 19, which implements our new technical governance. Thank you to everyone who read the document and participated in the process! This was the effort of two different DSF boards and dozens of community members. These changes were a revisitation of Django’s technical governance in which a simplification and reduction was made to make it more approachable to more people. The most exciting change (in my opinion), is the new Steering Council Eligibility criteria . We defined a set of wide range qualities that members of the Steering Council…

9月19日(土)

  • 02:00リリース・告知PythonDjango Weblog

    Proposed change to DSF voting membership

    We're proposing a new voting membership status to help us track active members. If you've voted in a Board election in the last two years, you're active, and you count toward quorum. If you haven't, you're still a member, but you won't count toward quorum until you tell us you want to vote. Why make this change? Quorum today is measured against every member on the rolls, including members who no longer take part in elections. As membership grows, quorum becomes harder to reach and puts our elections' validity at risk. Defining a quorum around active members is standard practice for nonprofits…

9月16日(水)

  • 21:50リリース・告知DjangoPythonDjango Weblog

    Executive Director Search Extended to September 22

    We are extending the search for the Django Software Foundation's first Executive Director . Applications now close at the end of Tuesday, September 22, 2026, anywhere on Earth (AoE). As long as it is still September 22 somewhere, your application counts. We are happy with the applications we received. We also knew several people had applications in progress, and it took a while for word about the role to reach everyone it should have. Giving people a little more time felt like the fairest option. If you were most of the way there, you have until Tuesday. If you have already applied, this does…

9月15日(火)

  • 22:20リリース・告知DjangoPythonDjango Weblog

    DjangoCon Europe 2027 is heading to Innsbruck, Austria! 🏔️⛷️🚠🇦🇹

    We’re delighted to announce that DjangoCon Europe 2027 will take place in Innsbruck, Austria, from February 17–21, 2027! Photo by Nicole Baster on Unsplash Each year, DjangoCon Europe brings together people from across the Django community to learn, share ideas, contribute, and spend time together. In 2027, that community will come together in Innsbruck for five days of Django, Python, and community. DjangoCon Europe is organized by community volunteers and has long been one of the highlights of the Django community calendar. Developers, contributors, newcomers, and long-time community member…

9月10日(木)

  • 20:00リリース・告知DjangoPythonDjango Weblog

    PyCharm & Django Fundraiser Extended to September 14

    The second half of our annual JetBrains fundraiser has been extended through September 14, 2026 . Thank you to JetBrains for the extra time. You still have time to renew your PyCharm license or give it a try. You get PyCharm at 30% off, and JetBrains donates 100% of your purchase or renewal to the DSF. This is one of the DSF's bigger fundraisers of the year, and we appreciate everyone who takes a look. The Executive Director search also closes on September 14, and we are curious to see who reaches out. JetBrains has been a steady sponsor for years, and it was great to see the chatter around t…

9月1日(火)

8月24日(月)

8月22日(土)

8月13日(木)

8月12日(水)

8月5日(水)

8月4日(火)

7月23日(木)

7月18日(土)

6月28日(日)

6月23日(火)

6月10日(水)

6月2日(火)

5月15日(金)

5月10日(日)

5月7日(木)

5月4日(月)