Dependency-Management on CuraDevOpshttps://curadevops.metacog.co.kr/tags/dependency-management/Recent content in Dependency-Management on CuraDevOpsHugoen-usTue, 27 Oct 2026 16:07:53 +0000Pillow CVE-2026-112900: Critical argument injection in Ghostscript EPS handlinghttps://curadevops.metacog.co.kr/insights/2026-10-27-pillow-cve-2026-112900-how-to-find-and-fix-it-with-gitlab/Tue, 27 Oct 2026 16:07:53 +0000https://curadevops.metacog.co.kr/insights/2026-10-27-pillow-cve-2026-112900-how-to-find-and-fix-it-with-gitlab/<ul> <li><strong>Platform/SRE — Skip</strong></li> <li><strong>CI/CD — Learn:</strong> Pillow 13.0.0 fixes a CVSS 9.2 argument injection; if Python build or app container images carry Pillow transitively, it is worth auditing, but EPSS 0.01 and no KEV listing mean there is no hard clock requiring pipeline changes now.</li> <li><strong>Leader — Skip</strong></li> <li><strong>Signals:</strong> CVE-2026-112900 — CISA KEV: not listed, EPSS 0.01</li> </ul>