Vulnerability Analysis
In-depth guides and analysis on vulnerability analysis from the Safeguard engineering team.
100 articles
Advantech ADAM-3600: 30 CVEs, 16 Need No Privileges; Fix 2.8.5.0 Is Beta
ADAM-3600 EdgeLink firmware before 2.8.5.0 has 30 CVEs, 16 needing no privileges. The only fixed build, 2.8.5.0, is labelled Beta. What to fix first.
Hono CVE-2026-111757: serveStatic's second decode and the 4.13.11 fix
CVE-2026-111757: hono's serveStatic decoded paths twice, so requests could skip middleware. Fixed in 4.13.11. The Node.js adapter's GHSA-rmxm-3fg6-px4f has no CVE.
Camunda 7 CVE-2026-109432: orQueries Expression Bypass, No CE Fix
CVE-2026-109432 lets Camunda 7 task queries run JUEL through orQueries. Fixes are enterprise only and CE 7.24.0 is affected. How it works and what to do.
Angular SSR CVE-2026-111752 and CVE-2026-111754: router DoS, open redirect
Two Angular SSR bugs: one URL can crash the SSR worker, another makes an open redirect. Fixed in 20.3.33, 21.2.25 and 22.2.1; Angular 19 gets no fix.
Black October 2026: PHP2Shell, Cisco and the Shrinking Enterprise Vulnerability Window
Two critical PHP flaws went from coordinated disclosure to widespread exploitation attempts within hours. Cisco disclosed critical vulnerabilities across security and communications infrastructure. Oracle's October security update addressed more than 1,200 CVEs, including 95 rated critical. The lesson for enterprise security teams is no longer simply “patch critical vulnerabilities.” It is to identify which critical vulnerabilities can become an operational incident before the normal patch cycle catches up.
Mercury CVE-2026-111057 and CVE-2026-111058: A Missing Comma, Then a Blocklist That Couldn't Hold
Two unauthenticated RCEs in Mercury, the notebook web app framework: a missing comma, then an open kernel API. Fixed in 3.2.6. Plus a scanner.
When the BOM Picks Your Versions: How Long Spring Boot Takes to Ship Security Fixes
Spring Boot patch releases upgrade managed libraries only at the patch level. Across 56 Boot releases and 2025-2026 Maven advisories, same-minor fixes arrived a median 23 days after reaching Maven Central, while 70 cases needed a newer minor that no patch release will take. What Boot 4.0.8 and 4.1.1 manage today, how to override versions, and a checker.
Ammonia RUSTSEC-2026-0373: How CSS URL() Slipped Past a Rust HTML Sanitizer
Ammonia 4.2.4 and 4.1.8 fix a bug where quoted CSS URL("...") skipped the URL filtering that url("...") received. How it worked, October's two earlier CSS and SVG fixes, which builder settings are affected, why RustSec flags 3.3 anyway, and a workspace checker.
Apache Camel's 39 CVEs of 19 October 2026: What They Are and Which Ones Apply to You
Apache published 39 CVEs for Apache Camel on 19 October 2026, including CVE-2026-78162 (CVSS 10.0) in camel-hazelcast. All are fixed in 4.18.5, 4.22.1 and 4.23.0. The 39 grouped by bug class, the five to check first, why 4.14 won't get a fix, and a dependency-list checker.
Junrar CVE-2026-97370: One Jump Instruction Hangs RAR Extraction, and Tika Bundled It
A RAR4 archive under 100 bytes can pin a Junrar extraction thread forever: an out-of-range jump in the RAR VM skips both the jump and the operation budget. Fixed in 7.6.1 on 21 July, published as CVE-2026-97370 on 15 October. How the loop and fix work, which Apache Tika releases bundle an affected Junrar, three repository-only advisories scanners miss, and a build checker.
CVE-2024-8606: High 2FA Bypass in Checkmk RestAPI
CVE-2024-8606 lets a Checkmk RestAPI user skip two factor authentication. Affects 2.2.0 and 2.3.0 before 2.2.0p34 and 2.3.0p16. Patch and check API logins.
CVE-2024-8422: High Use After Free in Zelio Soft 2
CVE-2024-8422 is a use after free in Schneider Electric Zelio Soft 2 triggered by a malicious project file. Update to 5.4.2.2 and open only trusted files.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.