Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Electron disclosed a custom-scheme CORS bypass and a preload cache poisoning bug on 29 Sept. Meanwhile 44.x ships Chromium 152 while Chrome is on 155.
Between 4 Sept and 9 Oct 2026, WSL shipped nine releases through 3.0.3. The notes carry no CVE IDs, but several entries tighten access control and input validation.
Three PostgreSQL JDBC driver CVEs from 7 and 8 October 2026 can store earlier traffic inside your data or let cleartext password auth through. All three are fixed by 42.7.14.
Predis 3.0.0 to 3.2.x reparses pipelines on cluster and replication connections, so CRLF in a key can run injected commands. Plus the Redis cluster bus and Valkey parser CVEs of September 2026.
On 13 October 2026 Okta published four Auth0 SDK advisories covering a max_age freshness bypass, an open redirect, credentials in URLs and a JWT parsing crash.
XSS leads all CVEs published 1 Sep to 16 Oct 2026 with 8.1%, yet none of 61 new KEV entries is XSS. KEV skews to authentication, path traversal and memory bugs.
WordPress 7.0.2, 6.9.5 and 6.8.6 shipped on 17 July 2026 with two SQL injection fixes. CISA listed both CVEs on 21 July.
Splunk's 19 August 2026 advisory fixes 17 flaws, including RCE in the MCP Server app and 9 AI Toolkit issues. Upgrade to MCP Server 1.2.1 and AI Toolkit 6.0.1.
Check Point research reported on 12 June 2026 that a SQLite checkpoint SQL injection and msgpack deserialization in LangGraph can chain to RCE on self-hosted servers.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
