Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
IBM App Connect Enterprise Certified Container infrastructure pods do not restrict egress. Upgrade the operator to 12.8.0 or 12.0.8 or higher, per IBM.
fast-toml through 0.5.4 is vulnerable to prototype pollution when parsing TOML with __proto__ keys. No fixed version is confirmed. Check reachability.
Selea Targa OCR-ANPR cameras have a hidden config page with a hard-coded developer password. Ask Selea for firmware and isolate the devices.
Selea Targa OCR-ANPR cameras have unauthenticated command injection in utils.php. Ask Selea for firmware and isolate the devices from your network.
Employee Records System 1.0 lets anyone upload and run files via uploadID.php, with exploitation noted in 2025. Take it offline or remove it.
Modern Events Calendar Lite up to 6.3.0 has an unauthenticated SQL injection in an AJAX action, but only when addslashes is disabled. Update the plugin.
Medivision Digital Signage 1.5.1 lets users become super admin by changing the ft[grp] parameter. No fix is confirmed, so restrict access to it now.
QiHang Media Web Digital Signage 3.0.9 lets anyone delete files through QH.aspx. No fix is confirmed, so block the endpoint and keep backups.
QiHang Media Web Digital Signage 3.0.9 lets anyone upload ASPX scripts through QH.aspx. No fix is confirmed, so block the endpoint and contact the vendor.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
