cisa-kev
Safeguard articles tagged "cisa-kev" — guides, analysis, and best practices for software supply chain and application security.
100 articles
Four Lower-Profile CVEs Across a File Server, a Database, an NVR, and an Email Gateway
Wing FTP Server, MongoDB, a Digiever network video recorder, and Libraesva's email security gateway each produced a confirmed-exploited CVE, none scoring above 8.8.
A Sudo Bug Let Local Users Reach Root Without Ever Appearing in Sudoers
CVE-2025-32463 let any local user leverage sudo's --chroot option to run commands as root, bypassing the sudoers access-control model entirely.
A 9.9-Severity Code Execution Bug in n8n Shows the Risk Built Into Workflow Automation
A flaw in n8n's expression evaluation system let authenticated users escape its execution sandbox entirely, confirmed exploited by malware documented targeting the platform.
A Critical SQL Injection in Drupal Core's Database Abstraction Layer Is Being Actively Exploited
CVE-2026-9082 hits the shared database abstraction API every Drupal module and query routes through, confirmed exploited just two days after Drupal's own security advisory.
DAEMON Tools Lite's Official Installers Were Trojanized and Signed With a Real Certificate
A supply-chain compromise of AVB Disc Soft's own build infrastructure distributed digitally-signed, trojanized DAEMON Tools Lite installers from the vendor's legitimate website for nearly a month.
The Windows CLFS Driver Produced a Second Confirmed-Exploited CVE, Two Years Apart
CVE-2023-36424 and CVE-2021-43226 both hit the same Windows Common Log File System Driver, one carrying a confirmed ransomware association, plus a separate Desktop Window Manager information leak.
Five More Microsoft CVEs Confirmed Exploited, Four on the Same Day
MSHTML, Windows Shell, Desktop Window Manager, and Office Word all produced confirmed-exploited bugs landing on CISA's KEV catalogue within a fifteen-day window in early 2026.
A Weather Station Gateway With Root-Level Command Injection, No Login Required
Smartbedded Meteobridge's CGI-shell-script web interface lets a remote unauthenticated attacker execute arbitrary commands as root, a legacy embedded architecture problem still live in 2026.
Laravel Livewire's Hydration Flaw Let Attackers Skip Authentication Entirely
CVE-2025-54068 lets unauthenticated attackers achieve remote command execution in Laravel Livewire v3 through how component property updates are hydrated, with no known workaround.
When the Security Console Becomes the Distribution Path: Apex One and Workspace ONE UEM
A directory traversal bug in Trend Micro Apex One and a four-year-old SSRF flaw in Omnissa Workspace ONE UEM both use management-plane trust against the fleets these tools are meant to protect.
HPE OneView and Fortra GoAnywhere MFT: Two Perfect-10 Unauthenticated RCEs
Infrastructure management and managed file transfer software rarely share a vulnerability post, but both HPE OneView and Fortra GoAnywhere MFT scored a maximum CVSS 10.0 for unauthenticated RCE.
Two Supply Chain Compromises, Two Different Failure Modes: TanStack npm and ASUS Live Update
A live npm registry attack against TanStack's trusted GitHub Actions publishing pipeline and a years-old ASUS Live Update client backdoor show two distinct ways software trust gets weaponized.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.