Resources

Supply Chain Security, in plain English.

Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.

Filter

All (12009)Vulnerability Analysis (12009)Security Guides (5118)Application Security (3307)Developer Tools (2961)Compliance (2830)AI Security (1723)Supply Chain (1423)Supply Chain Security (1028)Industry Analysis (1005)Research (585)Security (532)Product (514)DevSecOps (511)Tool Comparison (454)Open Source Security (417)Incident Analysis (399)AppSec (309)Cloud Security (300)Container Security (288)Software Supply Chain (282)Best Practices (264)Open Source (252)Buyer's Guides (217)Software Supply Chain Security (182)Vulnerability Management (150)Regulatory Compliance (144)Ranking (116)Concepts (116)Containers (100)Supply Chain Attacks (93)SBOM (77)Vulnerabilities (74)Threat Intelligence (66)Infrastructure Security (65)FAQ (50)Tools (50)SBOM & Compliance (41)Comparisons (36)Engineering (29)Licensing (26)Ransomware (24)Tutorials (24)Kubernetes Security (22)SecOps (22)Guides (22)Vulnerability Guides (20)Regulation (20)Industry Guides (19)Compliance & Regulations (18)Solutions (17)Emerging Technology (17)Threat Research (16)Case Studies (16)Tool Reviews (16)Vulnerability Response (16)Risk Management (16)Agent Security (16)Incident Response (15)Security Concepts (15)Identity Security (15)Cryptography (15)Compliance & Frameworks (15)Industry Events (14)Security Strategy (13)Buyer Guides (12)Frameworks (12)Web Security (11)Dependency Security (11)Data Breach (11)Career (10)Security News (10)Enterprise (9)Company (9)Culture (9)Architecture (8)Standards (8)Vulnerability Research (8)Strategy (8)Secure Development (7)Industry Insights (7)Industry Trends (7)Zero-Day Exploits (7)Network Security (7)How-To Guide (7)Dependency Management (7)Vendor Comparison (6)Security Operations (6)Organizational Security (6)Developer Security (6)Industry (6)Dev Practices (6)Code Security (5)Breach Analysis (5)Cryptocurrency Security (4)Product Launch (4)Mobile Security (4)Policy (4)Offensive Security (4)Tool Comparisons (4)Healthcare Security (3)Governance (3)Social Engineering (3)Hardware Security (3)Build Security (3)Policy & Compliance (3)API Security (3)Regional Security (3)Startup Security (3)Analysis (3)SBOM Standards (2)DeFi Security (2)Industry News (2)Security Architecture (2)Security Management (2)SBOM and Compliance (2)Zero-Day Analysis (2)Release (2)Security Culture (2)Threat Actors (2)Tools & Platforms (1)Tools & Techniques (1)Events (1)Architecture Security (1)Career Development (1)Browser Security (1)SBOM & Standards (1)Incident Postmortem (1)Kubernetes (1)Nation-State Threats (1)Language Security (1)Perspectives (1)Privacy & Security (1)Threat Analysis (1)Runtime Security (1)Emerging Threats (1)Threat Modeling (1)Healthcare (1)Data Security (1)Safeguard runs on VR and mixed reality headsets. Where a spatial view of your software estate helps, and where a plain screen is still better. (1)PKI Security (1)Privacy (1)Product Update (1)Technical (1)Lifecycle Management (1)Credential Attacks (1)Business Continuity (1)

Articles

Vulnerability Analysis

CVE-2026-24015: Critical Insecure Default in Apache IoTDB

CVE-2026-24015: Apache IoTDB before 1.3.7 and 2.0.7 has an insecure default configuration. Upgrade to 1.3.7 or 2.0.7 and restrict network access.

Oct 18, 20263 min read

Vulnerability Analysis

CVE-2026-24009: docling-core YAML Deserialization RCE, Fix 2.48.4

CVE-2026-24009: docling-core 2.21.0 to before 2.48.4 can run code when loading untrusted YAML with old PyYAML. Upgrade to 2.48.4 and PyYAML 5.4 or later.

Oct 18, 20265 min read

Vulnerability Analysis

CVE-2026-24002: Grist Pyodide Sandbox Escape, Fix 1.7.9

CVE-2026-24002: Grist before 1.7.9 using the pyodide sandbox lets a malicious document run processes on the server. Upgrade to 1.7.9 or use gvisor.

Oct 18, 20265 min read

Vulnerability Analysis

CVE-2026-23997: Stored XSS in FacturaScripts History View

CVE-2026-23997: FacturaScripts 2025.71 and earlier has stored XSS in the Observations field. Check for a patched release and limit who can edit records.

Oct 18, 20263 min read

Vulnerability Analysis

CVE-2026-23958: Critical Admin Takeover in DataEase, Fix 2.10.19

CVE-2026-23958: DataEase before 2.10.19 signs JWTs with an MD5 of the password, allowing offline brute force of the admin password. Upgrade to 2.10.19.

Oct 18, 20265 min read

Vulnerability Analysis

CVE-2026-23947: Code Injection in Orval via x-enumDescriptions

CVE-2026-23947: Orval can emit attacker-controlled code from an untrusted OpenAPI spec. Upgrade to Orval 8.0.2 and only build clients from specs you trust.

Oct 18, 20264 min read

Vulnerability Analysis

CVE-2026-23944: Critical Auth Bypass in Arcane, Fix 1.13.2

CVE-2026-23944: Arcane before 1.13.2 proxies unauthenticated requests to remote Docker agents. Upgrade to 1.13.2 and keep the manager off public networks.

Oct 18, 20263 min read

Vulnerability Analysis

CVE-2026-23941: HTTP Request Smuggling in Erlang OTP inets httpd

CVE-2026-23941: Erlang OTP inets httpd accepts duplicate Content-Length headers, enabling request smuggling. Upgrade to OTP 28.4.1, 27.3.4.9 or 26.2.5.18.

Oct 18, 20265 min read

Vulnerability Analysis

CVE-2026-23933: Hardcoded Session Key in Zabbix 7.4 Frontend

CVE-2026-23933: Zabbix 7.4.0 to 7.4.10 shipped a session signing key in its database seed. Upgrade to 7.4.11 and check SAML plus guest user setups.

Oct 18, 20263 min read

Stay informed

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

Book a demo Get started

No sales call required, even your agent can complete the purchase over MCP.