Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2026-48710, a moderate-severity Host-header validation gap in the Starlette framework underlying FastAPI, was still confirmed exploited — CVSS is not the only signal that matters.
CVE-2026-9586 abuses Switchvox's Polycom phone-provisioning endpoint, concatenating device-submitted XML directly into a SQL query with no authentication required.
CVE-2025-67038 triggers on a failed login attempt alone: the device server shells out to write a log entry, concatenating the attacker-supplied username unsanitised into the command.
CVE-2026-12569, a deserialization RCE in PTC's product lifecycle management platforms, carries CISA's confirmed ransomware campaign flag — a notable finding in specialised industrial software.
CVE-2026-48282, CVSS 10.0, is a path traversal vulnerability in Adobe ColdFusion that leads directly to arbitrary code execution — the platform's latest entry in a long history of critical CVEs.
CVE-2026-46817, which Oracle itself describes as easily exploitable, sits in the Payments component of Oracle E-Business Suite versions 12.2.3 through 12.2.15.
CVE-2026-16232 let an unauthenticated attacker obtain a genuine SmartConsole login token with full administrative privileges — confirmed exploited the same day it was disclosed.
CVE-2026-20253 lets an unauthenticated user create or truncate arbitrary files on Splunk Enterprise through a bundled PostgreSQL sidecar service, not the core application.
CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's own password-reset flow and gain full administrator access to the connected BI instance.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
