Vulnerability Analysis
In-depth guides and analysis on vulnerability analysis from the Safeguard engineering team.
577 articles
WinRAR CVE-2025-0411 Mark-of-the-Web Bypass
CVE-2025-0411 lets WinRAR archives bypass Windows Mark-of-the-Web when extracted. Here is the flaw, the observed campaigns, and the patching path.
Text4Shell (CVE-2022-42889): Apache Commons Text and the Haunting Echo of Log4Shell
A critical RCE vulnerability in Apache Commons Text drew immediate comparisons to Log4Shell. While less severe in practice, it highlighted how deeply embedded utility libraries create systemic risk.
F5 BIG-IP iControl REST RCE (CVE-2022-1388)
A critical iControl REST auth bypass let attackers gain root RCE on BIG-IP within days of disclosure. Impact, KEV status, timeline, and fixes.
libwebp heap buffer overflow zero-day (CVE-2023-4863)
A heap buffer overflow in libwebp, actively exploited in a zero-click iOS spyware chain, exposed browsers, Electron apps, and containers alike.
HTTP/2 Rapid Reset DDoS technique (CVE-2023-44487)
CVE-2023-44487 (HTTP/2 Rapid Reset) fueled record DDoS attacks by abusing stream resets. Here's the impact, timeline, and how to remediate it.
XZ Utils backdoor discovery (CVE-2024-3094)
A deep dive into CVE-2024-3094, the XZ Utils backdoor: affected versions, CVSS/EPSS context, full attack timeline, and remediation steps.
OpenSSH forwarded ssh-agent RCE (CVE-2023-38408)
CVE-2023-38408 lets a malicious SSH server hijack a forwarded ssh-agent to run code on the client. Impact, affected versions, and fixes.
OpenSSH agent forwarding RCE (CVE-2016-10009)
A malicious or compromised SSH server could abuse forwarded ssh-agent connections to load arbitrary PKCS#11 modules and run code on the client.
Shellshock Bash environment variable RCE (CVE-2014-6271)
A 2014 parsing flaw in Bash's function-export handling let attackers run arbitrary commands via environment variables — and it's still exploited today.
EternalBlue SMBv1 RCE (CVE-2017-0144)
EternalBlue (CVE-2017-0144) turned a Windows SMBv1 flaw into WannaCry and NotPetya. Here's the risk context, timeline, and fix.
BlueKeep RDP wormable RCE (CVE-2019-0708)
A deep dive into CVE-2019-0708 (BlueKeep), the wormable, pre-auth RDP RCE affecting legacy Windows — impact, timeline, and remediation steps.
CurveBall Windows CryptoAPI spoofing flaw (CVE-2020-0601)
CVE-2020-0601 (CurveBall) let attackers spoof trusted certificates via a Windows CryptoAPI flaw. Impact, timeline, and remediation steps inside.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.