Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
unstructured kept event handlers and javascript: links in its HTML output, so parsed documents ran script in reviewers' browsers. Fix and sink finder.
CERT Polska disclosed an unauthenticated Ollama path traversal that can plant a file loaded as root on restart. Here is what else changed in Ollama since September.
Langflow ran any command placed in an MCP stdio server config, wrapped in bash. With default auto-login, an exposed instance needs no account. Upgrade to 1.10.3.
A CVSS 10.0 path traversal in GitLab's repository commits API lets anyone read server files, including gitlab-secrets.json. CISA added it to KEV on 11 September.
An unauthenticated path traversal in WordPress core page template resolution can lead to RCE. Fixed in 7.1.2 and backported to 4.7. CISA added it to KEV on 25 September.
CISA added four NetScaler ADC and Gateway CVEs to KEV between 9 September and 4 October 2026, two of them unauthenticated RCE. Builds, checks and IR steps.
An exploited zero-day template injection and an unauthenticated authorization flaw in Adobe Commerce and Magento joined KEV in September. Patch, then rotate keys.
An unauthenticated path traversal in FortiMail's IBE feature lets attackers write arbitrary files. Fortinet confirmed exploitation and CISA added it to KEV on 1 October 2026.
A heap overflow in BIG-IP APM gives unauthenticated RCE when APM acts as an OAuth authorization server. F5 confirmed exploitation; CISA added it to KEV on 22 September.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
