SlackShell

SlackShell 説明と変更履歴 v1.0 このPowerShellモジュールには、Slack APIを利用してコマンド＆コントロールチャンネルを作成するさまざまな関数が含まれています。メイン関数であるStart-Shellは、ユーザーが指定したSlackチャンネルに接続し、指定されたSlackチームとユーザーに対して提供されたAPI認証トークンを使用して認証します。チャンネルに入力されたコマンドは、ホスト上でPowerShellによって実行されます。 SlackShellプロジェクトは、API呼び出しにInvoke-RestMethodを使用するため、PowerShell...

CVE-2026-0303

Checkov 任意コード実行 CVE-2026-0303 CVE: CVE-2026-0303 | CVSS 基本値: 6.3 | 深刻度: 低 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H CVE-2026-0303 - Checkov における任意コード実行の脆弱性。 2026年9月9日に Palo Alto Networks により公開。 影響を受けるバージョン: Checkov 3.2.0 から 3.2.531 修正バージョン: Checkov 3.2.532 TLDR 自動読み込みされる...

CVE-2026-0911

CVE-2026-0911 — Hustle モジュールインポート PoC WordPress プラグイン Hustle wordpress-popup、WPMU DEV の CVE-2026-0911 に関する、認証を必要とする モジュールインポート エンドポイント経由のアップロード動作をテストする 調査 / ペンテスト支援 ツールです。 このリポジトリまたはファイルセット内の CVE-2026-0911.py スクリプトは、所有している 、または書面による許可を得てテストしている システムでのみ使用してください。 概要（脆弱性の仕組み）...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

ImpactThe djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61599

djust is a Django extension providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance. Prior to version 1.0.7 , the live transport resolves the LiveView to mount from a client-supplied dotted path by calling __import__(), executing a module's top-level code bef...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

EUVD-2026-81307

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

PYSEC-2026-3891 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

Summary PraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset. This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...

Security Bulletin: Vulnerability in pip affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in pip has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

DEBIAN-CVE-2026-34789

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImportImportModule while restoring a...

UBUNTU-CVE-2026-34789

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImportImportModule while restoring a...

CVE-2026-34789 FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImportImportModule while restoring a...

EUVD-2026-60454

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImportImportModule while restoring a...

CVE-2026-34789 FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImportImportModule while restoring a...

Incomplete List of Disallowed Inputs

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-74886

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

PYSEC-2026-3745

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...