Vulnerability Research
In-depth guides and analysis on vulnerability research from the Safeguard engineering team.
8 articles
CVE-2026-86063: How a Branch Named Like a Commit Hash Bypassed Claude Code's Plugin Pinning
CVE-2026-86063: a branch named after a pinned SHA made git checkout install unreviewed Claude Code plugin code. Why it happens, safe pins, an audit script.
CVE-2026-100409 and GHSA-2mvv-9g7g-pfcg: Two Ways OpenNext Lost a Next.js Middleware Decision
CVE-2026-100409 and GHSA-2mvv-9g7g-pfcg let requests slip past Next.js middleware on OpenNext. Both bugs explained, versions to upgrade, and a checker.
Pickle on the Wire: 22 Advisories Show AI Inference Engines Trusting Their Own Network
22 advisories since 2025, 18 critical: AI inference engines unpickle data from network ports. The pattern, why internal ports leak, and a host check.
Backstage's August Security Release: 43 Advisories, a 40-Day Scanner Gap, and Four Still Missing
Backstage published 43 security advisories from 28 Aug. Scanners saw most 40 days later and four still not at all. What to upgrade and how to check.
Your Admin Port Is a Public API: Dgraph, Vitess, and the Go Debug Handlers You Didn't Mean to Ship
Dgraph and Vitess fixed critical bugs in unauthenticated admin ports. Go's pprof and expvar can expose the same surface. Lab, fixes and a checker.
Audio Processing Library Vulnerabilities: The Sound of Exploitation
Audio libraries parse complex binary formats in C code. They share the same vulnerability patterns as image and video codecs, with less security scrutiny.
Font File Vulnerability History: When Typography Becomes an Exploit
Font parsing has been a goldmine for attackers. The history of font vulnerabilities reveals deep supply chain risks in every operating system.
Zero-Day Vulnerabilities in Open Source: 2021 in Review
2021 saw a record number of zero-day exploits targeting open-source software. From Log4Shell to ProxyShell, here's what happened and what it means for defenders.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.