Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Microsoft's July 2026 SharePoint fixes, CVE-2026-56164 and CVE-2026-58644 among them, landed in CISA KEV within days. A table of builds, dates and what to check.
Two exploited flaws in Cisco Catalyst SD-WAN Manager reached CISA KEV within a week in June 2026. One fix covers both, and attackers dropped a malicious WAR file.
Claude Code before 2.1.163 let a malicious repository plus prompt injection overwrite shell startup files outside the macOS seatbelt sandbox. Fixed in 2.1.163.
NVD published CVE-2026-30623 on 15 July 2026. LiteLLM's MCP stdio transport ran any command it was given. Upgrade to v1.83.7-stable and allowlist launchers.
Cyera disclosed 10 llama.cpp flaws on 7 August 2026. The two critical llama-server bugs were unpatched in its check. Here is how to find and reduce exposure.
CERT/CC published VU#281278 on 30 July 2026: six SGLang vulnerabilities including unauthenticated RCE. No fix existed at publication, so mitigation is on the operator.
NVD published CVE-2026-47472 on 14 July 2026. A same-user local attacker can trigger deserialization in NVIDIA TensorRT-LLM's IPC channel. Here is how to scope it.
Node.js 22.23.2, 24.18.1 and 26.5.1 fix CVEs in HTTP/2, the Permission Model, HTTPS Agent and more. Which ones your code can actually reach depends on what you call.
The 14 August 2026 Go release patches net/http, crypto/tls, html/template, encoding/xml, encoding/asn1 and the module checksum tooling. Call-graph reachability sorts the urgent from the idle.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
