vulnerability data
Safeguard articles tagged "vulnerability data" — guides, analysis, and best practices for software supply chain and application security.
4 articles
When GitHub and OSV Disagree on Affected Versions: The Range Gap in 2026 Advisories
A GitHub advisory can record 'affected below X' and 'patched in Y' with Y above X. OSV-based tools flag the releases in between, GitHub's range calls them safe. 2026 data across eight ecosystems, three cases that went different ways (vm2, Angular, Hazelcast), and a script that finds the gaps in your lockfiles.
Old Bug, New CVE: Why 373 CVEs in 2026 Arrived Months After the Advisory
CVE-2024-58398 was published on 17 October 2026 for a Coder bug disclosed and fixed in October 2024. In 2026, 373 CVEs arrived three months or more after GitHub's advisory, 311 of them from VulnCheck. Data across eight ecosystems, the CNA rules behind late IDs and old years, and a script that tells a new bug from an old one.
Fixing the Fix: Incomplete-Fix Advisories Are Six Times More Common in 2026
We counted GitHub-reviewed advisories that describe an incomplete fix or patch bypass. In 2026 they are 2.31% of all advisories, up from under 0.4% a year. The data, the bug classes that keep coming back, and what to change in how you ship a fix.
CISA's CVE Quality Era Framework, Measured: What 81,803 CVE Records From 2026 Actually Contain
CISA's CVE Quality Era framework sets no record criteria yet. We checked 81,803 2026 CVE records: 22% have score, CWE, versions and a fix link.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.