Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A bypass of Python's tarfile extraction filter, CVE-2026-11940, lets a crafted archive write outside the destination. It matters only where you extract archives you did not build.
Every field in a KEV catalog entry explained using the real PAN-OS entry added on 14 October 2026, plus the jq commands to pull it yourself.
The NVD record for CVE-2026-0322 carries both a CVSS 4.0 and a 3.1 score. Here is how to pull each with jq and decode the 4.0 vector string.
An NVD record can carry a CISA SSVC block. For CVE-2026-0322 it says exploitation is active, not automatable, and total technical impact.
A researcher asks for a CVE for a bug in your product. Who assigns it, in what order, and how long can you wait? The CNA Rules v4.2.0 answer all three.
Three ways to get a CVE ID for a flaw in your product, a table to pick one, and the record fields the CNA Rules 4.2.0 say you cannot skip.
The CISA KEV list has no ROS entries, but the NVD does. How to read that gap, with real CVEs for ROS tools, ROS 2 secure DDS and a humanoid robot platform published in August 2026.
GitLab's 12 October critical patch fixes an unauthenticated code execution bug in the CI/CD regex compiler, plus 23 other issues. Check your version and upgrade.
Docker Engine 29.8.2 fixes a DNS trick that turns off registry TLS, a Swarm overlay injection bug and ten BuildKit CVEs, including build cache poisoning.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
