Safeguard
Resources

Supply Chain Security, in plain English.

Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.

All (577)AI Security (786)Vulnerability Analysis (577)Security (523)DevSecOps (497)Application Security (490)Open Source Security (412)AppSec (309)Compliance (304)Industry Analysis (295)Container Security (284)Open Source (252)Best Practices (252)Cloud Security (239)Buyer's Guides (216)Software Supply Chain Security (178)Incident Analysis (139)Regulatory Compliance (138)Vulnerability Management (135)Security Guides (124)Concepts (116)Containers (100)Supply Chain Attacks (93)SBOM (76)Vulnerabilities (72)Product (69)Threat Intelligence (65)Supply Chain Security (55)Supply Chain (55)Infrastructure Security (52)Tools (50)FAQ (50)SBOM & Compliance (41)Comparisons (32)Licensing (26)Engineering (24)Tutorials (24)Ransomware (24)Kubernetes Security (22)Guides (22)SecOps (21)Regulation (20)Vulnerability Guides (20)Industry Guides (19)Case Studies (18)Compliance & Regulations (18)Solutions (17)Emerging Technology (17)Agent Security (16)Vulnerability Response (16)Threat Research (16)Risk Management (16)Tool Reviews (16)Cryptography (15)Compliance & Frameworks (15)Security Concepts (15)Identity Security (15)Incident Response (15)Industry Events (14)Security Strategy (13)Frameworks (12)Data Breach (11)Dependency Security (11)Web Security (11)Career (10)Company (9)Culture (9)Enterprise (9)Standards (8)Strategy (8)Architecture (8)Secure Development (7)Industry Insights (7)Industry Trends (7)How-To Guide (7)Zero-Day Exploits (7)Network Security (7)Dependency Management (7)Industry (6)Vendor Comparison (6)Dev Practices (6)Security Operations (6)Research (6)Organizational Security (6)Developer Security (6)Breach Analysis (5)Code Security (5)Product Launch (4)Policy (4)Cryptocurrency Security (4)Tool Comparison (4)Mobile Security (4)Offensive Security (4)Tool Comparisons (4)Build Security (3)Healthcare Security (3)Governance (3)Social Engineering (3)Vulnerability Research (3)Regional Security (3)Policy & Compliance (3)SBOM Standards (3)Software Supply Chain (3)Analysis (3)Startup Security (3)Hardware Security (3)Zero-Day Analysis (2)Industry News (2)Release (2)SBOM and Compliance (2)Security Management (2)Threat Actors (2)API Security (2)Security Architecture (2)Security Culture (2)DeFi Security (2)Incident Postmortem (1)Technical (1)Product Update (1)Healthcare (1)Language Security (1)Emerging Threats (1)Privacy (1)Events (1)Lifecycle Management (1)Career Development (1)Tools & Platforms (1)Threat Modeling (1)Browser Security (1)Threat Analysis (1)Business Continuity (1)Runtime Security (1)Credential Attacks (1)PKI Security (1)Architecture Security (1)Nation-State Threats (1)Tools & Techniques (1)Privacy & Security (1)

Articles

RSS feed
Vulnerability Analysis

CVE-2021-33503: ReDoS in urllib3 URL authority parsing

CVE-2021-33503 exposes urllib3 before 1.26.5 to a ReDoS in URL authority parsing, letting attacker URLs exhaust CPU. What to patch and why.

Jun 28, 20267 min read
Vulnerability Analysis

CVE-2020-26137: CRLF injection in urllib3 header handling

CVE-2020-26137 let attackers inject CRLF sequences into urllib3-built HTTP requests. Here's the impact, affected versions, and how to remediate it.

Jun 28, 20267 min read
Vulnerability Analysis

CVE-2017-18342: Arbitrary code execution via PyYAML yaml....

CVE-2017-18342 lets attackers achieve remote code execution via PyYAML's yaml.load(), which deserialized untrusted YAML into live Python objects by default.

Jun 28, 20268 min read
Vulnerability Analysis

CVE-2020-1747: PyYAML full_load still allows code execution

CVE-2020-1747 shows PyYAML's FullLoader and full_load() could still trigger arbitrary code execution on untrusted YAML before 5.3.1. Here's the full breakdown.

Jun 27, 20268 min read
Vulnerability Analysis

CVE-2020-14343: PyYAML arbitrary code execution via pytho...

CVE-2020-14343 lets attackers run arbitrary code via PyYAML's python/object/new tag, bypassing an earlier FullLoader fix. Versions, CVSS, and remediation inside.

Jun 27, 20267 min read
Vulnerability Analysis

CVE-2022-22817: Arbitrary code execution in Pillow via Im...

CVE-2022-22817 lets attackers achieve arbitrary code execution via Pillow's ImageMath.eval() when environment data is attacker-controlled. Patch to 9.0.1+.

Jun 27, 20268 min read
Vulnerability Analysis

CVE-2020-35654: Buffer over-read in Pillow PCX decoder

A buffer over-read in Pillow's PCX decoder (CVE-2020-35654) could crash image-processing services on crafted files. Here's the fix and detection guidance.

Jun 27, 20267 min read
Vulnerability Analysis

CVE-2020-35655: Decompression bomb DoS in Pillow

A crafted image file could force Pillow to over-allocate memory, causing denial of service. Here's what CVE-2020-35655 affects, its severity, and how to remediate it.

Jun 27, 20267 min read
Vulnerability Analysis

CVE-2023-50447: Arbitrary code execution via Pillow Image...

A patch bypass in Pillow's ImageMath.eval() reopens arbitrary code execution first flagged in CVE-2022-22817. Here's what changed and how to remediate it.

Jun 27, 20268 min read
Page 26 of 65

Stay informed

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

Book a demoGet started

No sales call required, even your agent can complete the purchase over MCP.

Blog — vulnerability-analysis (Page 26) | Safeguard — Software Supply Chain Security Insights