Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
FOG 1.5.10.1673 and below allows unauthenticated access that can dump the full SQL database. Upgrade to 1.5.10.1693 or 1.6.0-beta.2225 and review exposure.
ERPNext before 14.89.2, and 15.0.0 through 15.75.1, has error-based SQL injection in some endpoints. Upgrade to 14.89.2 or 15.76.0 and review accounts.
Roo Code 3.25.23 and below did not protect .code-workspace files, so auto-approved writes could plant tasks that run on reopen. Upgrade to 3.26.0 or later.
Roo Code 3.26.6 and below used unsanitized pull request data in a privileged GitHub workflow, risking runner takeover. Fixed in 3.26.7; audit workflows.
The Makeaholic WordPress theme through 1.8.5 lacks an authorization check, allowing limited changes without login. No fix in the record; check vendor.
The MaxCoach WordPress theme through 3.2.5 has a PHP file inclusion flaw that allows local file inclusion. The record lists no fix; check the vendor.
Eventlet before 0.40.3 mishandles HTTP trailers in its WSGI server, allowing request smuggling. Upgrade to 0.40.3 or avoid untrusted clients.
Galette before 1.2.0 lets a forged POST request on an existing account raise its privileges. Upgrade the membership app to 1.2.0 and review admin accounts.
PCRE2 10.45 has a heap over-read when the scs verb is combined with ACCEPT, which may leak memory. Upgrade to 10.46 or your distro's patched package.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
