vulnerability-management
Safeguard articles tagged "vulnerability-management" — guides, analysis, and best practices for software supply chain and application security.
689 articles
CVE-2022-31160: Understanding the jQuery UI Checkboxradio XSS
CVE-2022-31160 is a cross-site scripting flaw in jQuery UI's checkboxradio widget, fixed in 1.13.2. Here is how it works and how to remediate it.
The Cost Multiplier Effect of Fixing Vulnerabilities in P...
A misconfigured base image caught at build time costs minutes to fix. Found in production, the same CVE triggers incident response and audits.
CVE Numbering Authority (CNA) status: why it matters when...
JFrog has issued its own CVEs since 2021 as a CVE Numbering Authority. Here's what CNA status really controls, where it falls short, and how to verify vendor-disclosed vulnerabilities.
Zip Slip vulnerability cheat sheet
A concrete, question-driven cheat sheet on Zip Slip: how the archive-extraction path traversal bug works, real CVEs, and how to detect and fix it.
What is a Software Bill of Materials (SBOM) and why it ma...
A software bill of materials (SBOM) is a live inventory of every dependency in your software. Here's why it matters, how JFrog handles it, and how Safeguard does better.
Why 'We Have an SBOM' Isn't the Same as 'We Are Secure'
An SBOM tells you what's in your software, not whether it's safe. Here's why inventory alone can't stop supply chain attacks like XZ Utils or SolarWinds.
Software Composition Analysis (SCA) explained: how it fin...
SCA scans your dependency tree against CVE databases to catch vulnerable open-source packages like Log4Shell before they reach production.
Vulnerability Management Services: What They Do and How to Choose
Vulnerability management services promise to find, prioritize, and track your security weaknesses so you don't have to. Here is what they actually cover, where the gaps are, and what to ask before you buy.
The Gap Between SBOM Generation and SBOM Consumption
Most companies generate SBOMs to satisfy a compliance checkbox, then let them sit unread. Here is why SBOM consumption lags generation, and how to close the gap.
VEX Documents: The Missing Context That Makes SBOMs Actio...
SBOMs list every component but stay silent on whether a CVE is actually exploitable. VEX documents supply that missing context — here's how the standard works.
10 Java security best practices
10 Java security best practices security teams should enforce across dependency management, deserialization, injection, secrets, and build pipelines.
CVE explained: how vulnerabilities get identified and scored
A CVE ID and its CVSS score come from different organizations entirely. Here's how identification and severity scoring actually work, using Log4Shell and the 2024 NVD backlog as examples.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.