Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2006-10003 is a critical heap overflow in Perl XML::Parser through 2.47. Upgrade to 2.48 or later when released, or apply the patch and distro updates.
Scanners close a finding when you install the fixed version. Four 2026 advisories show the patched release can add an opt-in check, keep an open default or only warn. What to check, and a script to find these in your dependencies.
CISA's 8 October 2026 advisory ICSA-26-281-02 lists six flaws in Grid Protection Alliance openPDC and openHistorian, including a critical deserialization bug. No exploitation is reported.
ENISA's 22 September 2026 report finds vulnerabilities behind 60.4% of intrusions with a known vector, 48,000+ new CVEs in 2025 and rising npm compromises. What suppliers should do.
Microsoft first listed CVE-2026-65660 as a 6.5 spoofing flaw. It is an 8.8 code injection bug, attackers are chaining it pre-auth, and CISA added it to KEV on 25 September.
A single URI-encoded character in a request to Catalyst SD-WAN Manager bypasses authentication and grants admin API access. Cisco confirmed exploitation and CISA set a 3 October deadline.
A pre-auth zero-day in Check Point Security Management and a VPN certificate bug in Security Gateway were both exploited. CISA added them to KEV on 22 September. Here is what to patch and hunt.
A ScreenConnect client flaw let files be transferred and executed in a live session without host confirmation. CISA added it to KEV on 11 September. Patch to 26.6.5 and reinstall clients.
CVE-2026-67279 is the unauthenticated SSH half of the MikroTrick chain against RouterOS. CISA listed it on 25 September. One related fix was incomplete, so September upgrades need another pass.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
