Security Guides
What does Not Defined mean in a CVSS security requirement?
Not Defined means you have not chosen a value, and CVSS v4.0 treats it the same as High. Here is why, and why a first score with blanks looks high.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSecurity Guides
What do C:H, I:L and A:N mean at the end of a CVSS vector?
The last three codes in a CVSS 3.1 vector score confidentiality, integrity and availability loss as High, Low or None. What each level means for triage.
Oct 19, 20264 min read
Security Guides
What does Attack Complexity High mean, and what changed in CVSS 4.0?
AC:H in CVSS 3.1 means conditions beyond the attacker's control stand in the way. CVSS 4.0 splits the idea into AC and AT. How to read both in scan output.
Oct 19, 20264 min read
Security Guides
CVE version status 'unknown': does it mean your version is safe?
In a CVE record, a version marked unknown is not a clean result. Learn how affected, unaffected and unknown work, and how defaultStatus can mislead.
Oct 19, 20264 min read
Security Guides
CVE tags explained: disputed, unsupported when assigned, hosted only
Three CNA tags change how you should read a CVE. See what each means, how many NVD records carry them on 19 October 2026, and what a scanner team should do.
Oct 19, 20263 min read
Security Guides
CVE reference tags: how to find the patch or vendor advisory fast
CVE records tag every link: patch, vendor-advisory, mitigation, exploit and more. Learn what each tag means and how to find the fix link in under a minute.
Oct 19, 20264 min read
Security Guides
What do CVE states Reserved, Published and Rejected mean for ops?
A CVE record is Reserved, Published or Rejected. Learn what each state means, why a Reserved ID has no details and what to do with a Rejected finding.
Oct 19, 20264 min read
Security Guides
CVE dates explained: reserved, published or public, which to use?
A CVE record carries several dates. Learn what reserved, assigned, public and published each mean, and which one belongs in a patch SLA or a report.
Oct 19, 20263 min read
Security Guides
What should a customer security bulletin contain? A template
A reusable customer security bulletin template for software vendors: title, status, affected versions, impact, fix, workaround, dates and contact.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.