Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
ADAM-3600 EdgeLink firmware before 2.8.5.0 has 30 CVEs, 16 needing no privileges. The only fixed build, 2.8.5.0, is labelled Beta. What to fix first.
CVE-2026-111757: hono's serveStatic decoded paths twice, so requests could skip middleware. Fixed in 4.13.11. The Node.js adapter's GHSA-rmxm-3fg6-px4f has no CVE.
CVE-2026-109432 lets Camunda 7 task queries run JUEL through orQueries. Fixes are enterprise only and CE 7.24.0 is affected. How it works and what to do.
Two Angular SSR bugs: one URL can crash the SSR worker, another makes an open redirect. Fixed in 20.3.33, 21.2.25 and 22.2.1; Angular 19 gets no fix.
Two critical PHP flaws went from coordinated disclosure to widespread exploitation attempts within hours. Cisco disclosed critical vulnerabilities across security and communications infrastructure. Oracle's October security update addressed more than 1,200 CVEs, including 95 rated critical. The lesson for enterprise security teams is no longer simply “patch critical vulnerabilities.” It is to identify which critical vulnerabilities can become an operational incident before the normal patch cycle catches up.
Two unauthenticated RCEs in Mercury, the notebook web app framework: a missing comma, then an open kernel API. Fixed in 3.2.6. Plus a scanner.
Spring Boot patch releases upgrade managed libraries only at the patch level. Across 56 Boot releases and 2025-2026 Maven advisories, same-minor fixes arrived a median 23 days after reaching Maven Central, while 70 cases needed a newer minor that no patch release will take. What Boot 4.0.8 and 4.1.1 manage today, how to override versions, and a checker.
Ammonia 4.2.4 and 4.1.8 fix a bug where quoted CSS URL("...") skipped the URL filtering that url("...") received. How it worked, October's two earlier CSS and SVG fixes, which builder settings are affected, why RustSec flags 3.3 anyway, and a workspace checker.
Apache published 39 CVEs for Apache Camel on 19 October 2026, including CVE-2026-78162 (CVSS 10.0) in camel-hazelcast. All are fixed in 4.18.5, 4.22.1 and 4.23.0. The 39 grouped by bug class, the five to check first, why 4.14 won't get a fix, and a dependency-list checker.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
