Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A malicious Nx Console extension harvested developer credentials from disk and memory before being pulled from two marketplaces, in windows as short as 18 and as long as 36 minutes.
CVE-2017-7921 spans seven Hikvision camera product families and grants unauthenticated privilege escalation — confirmed exploited nearly nine years after its original disclosure.
CVE-2025-32432 scores a maximum 10.0 and is confirmed exploited — and NVD's own record calls it an additional fix for a 2023 vulnerability that wasn't fully closed the first time.
Three unrelated self-hosted admin tools — a hosting control panel, a Git server, and a database manager — each had a confirmed-exploited vulnerability targeting the same convenience-over-process tradeoff.
A decade-old Juniper ScreenOS backdoor-style auth bypass and a current SonicWall SMA1000 authorization gap both let attackers seize control of the appliance meant to enforce access control.
A 2014 Shellshock-family Bash bug and a fresh telnetd argument injection in InetUtils both reached CISA's KEV catalogue, both driven by untrusted input crossing a privilege boundary.
In eleven days, SmarterMail picked up three confirmed-exploited CVEs, all unauthenticated, all tied to known ransomware use — file upload, password-reset bypass, and an API missing authentication.
vCenter Server, Aria Operations, and VMware Tools each contributed a confirmed-exploited vulnerability, spanning an unauthenticated RCE, a migration-time command injection, and a local privilege escalation.
Two separate deserialization RCEs and a security-control bypass in Web Help Desk, one confirmed for ransomware use, plus a denial-of-service bug in Serv-U.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
