vulnerability-management
Safeguard articles tagged "vulnerability-management" — guides, analysis, and best practices for software supply chain and application security.
689 articles
10 Docker image security best practices
Ten concrete Docker image security practices — minimal base images, secret handling, reachability-based scanning, non-root runtimes, and SBOMs — with real CVEs and data.
CVE-2020-26137: CRLF injection in urllib3 header handling
CVE-2020-26137 let attackers inject CRLF sequences into urllib3-built HTTP requests. Here's the impact, affected versions, and how to remediate it.
How to Choose a Vulnerability Assessment Solution
A vulnerability assessment solution finds, ranks, and tracks weaknesses across your systems. Here is what separates a useful one from a report generator.
Choosing secure base images for containers
Base image choice drives most of your container's attack surface. Here's what secure Docker base images actually require, with concrete CVE data.
Distroless container images explained
Distroless images cut container size by up to 90% and eliminate OS-level CVEs, but they don't secure app dependencies. Here's how they work and where they fall short.
Alpine vs distroless: which base image is more secure
Alpine and distroless both shrink attack surface differently. We compare real CVEs, musl risks, and patch tradeoffs to settle which base image actually wins.
Scanning container images in CI/CD pipelines
Where to put container image scanning in your CI/CD pipeline, what it actually catches, and how to stop CVE floods from blocking every build.
CVE-2019-1010083: Denial of service in Flask via large mu...
CVE-2019-1010083 let attackers crash Flask apps with crafted multipart requests. Here's the impact, affected versions, and how to remediate the DoS flaw.
How AppSec teams cut false-positive triage time
AppSec teams drown in false positives. See how Safeguard's supply-chain-native triage compares to Checkmarx's SAST-driven approach on reachability, context, and workflow fit.
CVE-2023-34455: snappy-java's Unchecked Chunk Length DoS
CVE-2023-34455 lets an attacker crash a JVM by feeding snappy-java a bogus chunk length. Here is the root cause, affected versions, and the fix.
CWE Meaning: What Common Weakness Enumeration Is and Why It Matters
The CWE meaning is simpler than it looks: a shared catalog of software weakness types. Here is how it differs from CVE and how to actually use it.
CVE-2020-27783: Cross-site scripting bypass in lxml html ...
CVE-2020-27783 lets attackers bypass lxml's html.clean.Cleaner sanitizer to smuggle XSS past HTML cleaning. Here's what's affected and how to remediate it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.