Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on 14 October 2026, and under BOD 26-04 all four are due on 17 October, three days later.
PgBouncer 1.26.1 fixes an authentication bypass present since 1.17.0: anyone who knows one auth_file user's password could log in as any other SCRAM user, including admins and database superusers.
CVE-2025-61624 hit CISA KEV on 16 Oct. Unit 42 says it turned FortiOS admin access into root for the PEERSTITCH implant. Fixes, hunting and a checker.
CVE-2026-85747: distribution's registry client skipped digest checks. The fix for github.com/docker/distribution has no tag. Lab tests, pins, checker.
Vert.x 4.5.35, 5.1.10 and 5.2.1 fix 12 CVEs, incl. DB2 client deserialization. Quarkus 3.40.1 still pins 4.5.34. Who's exposed, a BOM fix, a checker.
Better Auth 1.4.0-beta.18 to 1.7.6 let an OAuth state sign in as any user via Magic Link. How it worked, who is exposed, and a project checker.
KEDA 2.20.2 and earlier send the operator's cluster token to a tenant-chosen Vault URL. Why December's fix missed it, what 2.21 breaks, and an audit.
CVE-2026-21589 is in CISA KEV, due 18 Oct. Fixed versions for all eight Atlassian Data Center products, how the bug works, and a log and webroot check.
Argo CD PreDelete and PostDelete hooks skipped AppProject checks from 2.10 on. Fixed versions, why Helm hooks count, no 2.x patch, and an audit script.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
