Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A 2014 Shellshock-family Bash bug and a fresh telnetd argument injection in InetUtils both reached CISA's KEV catalogue, both driven by untrusted input crossing a privilege boundary.
In eleven days, SmarterMail picked up three confirmed-exploited CVEs, all unauthenticated, all tied to known ransomware use — file upload, password-reset bypass, and an API missing authentication.
vCenter Server, Aria Operations, and VMware Tools each contributed a confirmed-exploited vulnerability, spanning an unauthenticated RCE, a migration-time command injection, and a local privilege escalation.
Two separate deserialization RCEs and a security-control bypass in Web Help Desk, one confirmed for ransomware use, plus a denial-of-service bug in Serv-U.
Two nearly identical unauthenticated RCE vulnerabilities in Ivanti Endpoint Manager Mobile, plus a perfect-10 in Sentry and a credential-leaking bypass in Endpoint Manager.
A SQL injection and an access-control bug in FortiClient EMS, a path traversal and command injection pair in FortiWeb — Fortinet's endpoint management and WAF products join the list.
PeopleSoft and E-Business Suite together account for three ransomware-associated Oracle vulnerabilities in a single year — an unusually high concentration for one vendor.
V8, Dawn, Skia, ANGLE, and Chromium's CSS engine each produced confirmed-exploited vulnerabilities — ten total this year across five distinct browser subsystems.
Use-after-free, memory corruption, integer overflow — nine Apple vulnerabilities spanning nearly a decade of disclosure dates were confirmed exploited across the company's full platform range.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
