Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Grafana published a plugin zip slip RCE (CVE-2026-15815) in September and a batch of authorization fixes on 13 October 2026. Which ones reach you depends on plugins, SAML and auth proxy.
A Metabase flaw lets anyone who can run native queries on an H2 data source call FILE_READ and FILE_WRITE on the server. The bundled sample database is H2. Fixed 13 October 2026.
Seven pg_partman CVEs published 18 September 2026 let a partman_user role run SQL as the background worker, which defaults to superuser. The fix is 5.5.0.
Five MariaDB server CVEs published 9 October 2026 are fixed in 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2. Two of them let a user with the FILE privilege reach the host.
A crafted trained model can run code on Elasticsearch, then 6 October brought role escalation, cross-cluster and DoS fixes. Target 8.19.23, 9.4.8 or 9.5.5.
Keycloak 26.8.1, released 13 October 2026, ships fixes for a manage-users to realm-admin escalation, a 2FA setup bypass, PAR replay and more than a dozen other CVEs.
authentik's API returned stored credentials to any account with view permission on providers, sources and outposts. Fixed in 2026.2.7, 2026.5.7 and 2026.8.2.
Okta published eleven Access Gateway advisories on 8 September 2026, including an 8.1 authorization bypass and SAML-to-SQL injection. All are fixed in 2026.9.1.
The Auth0 AD/LDAP Connector had an unauthenticated localhost admin panel exposing AD service credentials, a stored XSS rated 9.0 and a local privilege escalation.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
