Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
joserfc's JWS JSON deserializer accepted a message with zero signatures as verified. Fixed in 1.7.4, with two DoS fixes following in 1.7.5.
Okta's 13 October 2026 advisories hit two on-premises MFA agents: a RADIUS Agent that exposed its API token to local services and a parser that loops forever.
We counted every CISA KEV addition from 1 September to 16 October 2026: 61 CVEs across 36 vendors, 52 of them with a three-day due date.
Of 61 KEV additions from 1 Sep to 16 Oct 2026, 34 landed within a week of the CVE going public. Six were more than a year old, and one record was later rejected.
For KEV additions from 1 Sep to 16 Oct 2026, 26 of 61 CVEs had no EPSS score the day before, and 22 more scored below 0.01.
We split all 390,724 EPSS scores from 17 Oct 2026 by KEV status. Median for KEV CVEs: 0.49. For everything else: 0.0064. 460 KEV CVEs still score below 0.1.
We diffed EPSS scores for 366,809 CVEs between 1 Sep and 17 Oct 2026. 34 fell by 0.5 or more, and 23 of those are in CISA KEV. Only 8 rose that much.
NVD lists 23,469 non-rejected CVEs published 1 Sep to 15 Oct 2026, from 279 sources. Four CNAs, VulnCheck, Microsoft, kernel.org and GitHub, account for 42.4%.
Of 23,469 CVEs published 1 Sep to 15 Oct 2026, NVD lists 5,915 as Analyzed and 6,119 with CPE data. All 37 KEV CVEs from the window were analyzed.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
