Vulnerability Analysis
The NVD backlog and its impact on vulnerability management
The NVD backlog leaves thousands of CVEs unscored each month, forcing security teams to rethink how they prioritize and triage vulnerabilities.
May 1, 20266 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
Critical RCE via ImageMagick: hacking Docker containers
ImageTragick and CVE-2022-44268 show how one image-processing library keeps handing attackers shells and secrets inside Docker containers.
May 1, 20266 min read
Vulnerability Analysis
GHSA vs CVE vs OSV: comparing vulnerability identifier formats
A plain-language breakdown of CVE, GHSA, and OSV vulnerability identifiers, who assigns them, how they differ, and why one flaw can carry three IDs.
Apr 30, 20267 min read
Vulnerability Analysis
Understanding zero-day vulnerabilities and incident response
A concrete look at zero-day vulnerabilities and incident response, using Log4Shell, MOVEit, and CISA KEV data to explain how fast defenders must move.
Apr 30, 20266 min read
Vulnerability Analysis
Reachability analysis for prioritizing vulnerabilities
Reachability analysis cuts vulnerability noise by 70-90% by tracing which CVEs are actually callable from your code, not just present in your dependency tree.
Apr 29, 20268 min read
Vulnerability Analysis
Aqua Vulnerability Database (AVD) explained
AVD powers Trivy's scan results, but it's a curated aggregator, not a primary source. Here's how it differs from NVD, where its gaps are, and how to close them.
Apr 27, 20267 min read
Vulnerability Analysis
How Trivy sources vulnerability data (NVD, vendor advisor...
Trivy's CVE data comes from NVD, GHSA, and distro trackers compiled into a periodic snapshot — not kube-hunter. Here's how the pipeline really works, and where it lags.
Apr 27, 20267 min read
Vulnerability Analysis
CVE-2025-32756 in FortiVoice: HTTP Stack Overflow to Root RCE
A stack-based buffer overflow in FortiVoice and FortiMail web portals lets unauthenticated attackers execute root commands over HTTPS.
Apr 26, 20265 min read
Vulnerability Analysis
CVE-2025-20188 in Cisco IOS XE WLC: Hardcoded JWT to Root RCE
A hardcoded JSON Web Token in Cisco's Wireless LAN Controller gives unauthenticated attackers a path to root via arbitrary file upload.
Apr 25, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.