Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
We counted GitHub-reviewed advisories published 1 Sep to 16 Oct 2026. npm had 533, PyPI 359 and Go 313. 55.6% rate High or Critical, and 10 packages account for 16.8%.
For 1,089 CVEs matched to a GitHub advisory, 77.1% had an NVD publish time earlier than the advisory's. The median gap was 6.9 hours, and 7.4 days for non-GitHub CNAs.
Half of the 61 CVEs added to KEV are rated Critical, against 9.9% of all 23,934 new CVEs. Yet only 0.80% of new Critical CVEs reached KEV in the window.
Of 23,934 CVEs published 1 Sep to 16 Oct 2026, 7,467 have a CVSS 4.0 score. VulnCheck and VulDB supplied 4,324 of them, and none came from NVD itself.
A default MLflow tracking server let anyone make it fetch internal URLs and read the answer. CISA added CVE-2026-64849 to KEV on 19 August 2026.
A Ray dashboard check that trusted the User-Agent header lets a web page run code on a developer's machine. CISA added it to KEV on 17 August 2026.
SimpleHelp 5.5.15 and earlier trusted unsigned OIDC identity tokens, giving attackers a technician session. CISA listed CVE-2026-48558 on 29 June 2026.
SolarWinds Serv-U 15.5.4 and earlier can be crashed without login by a POST using deflate encoding. CISA listed CVE-2026-28318 on 5 June 2026.
Ivanti disclosed two critical Sentry flaws on 9 June 2026. A public exploit followed the next day and CISA listed CVE-2026-10520 on 11 June.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
