Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
haxcms-nodejs 11.0.6 and below ship with JWT checks off by default, so a stock deployment has no login. Upgrade to 11.0.7 and set your own configuration.
Mist Community Edition up to 4.7.1 has an access control flaw in create_token, rated High. Upgrade to 4.7.2 and review API tokens that already exist.
Cherry Studio 1.2.5 to 1.5.1 has OS command injection when connecting to a malicious MCP server, rated Critical. Upgrade to 1.5.2 and vet MCP servers.
Cherry Studio 1.4.8 to 1.5.0 has a one-click remote code execution flaw in its custom URL handler, rated High. Upgrade to 1.5.2 or later to cover both.
Blogbook edit_post.php SQL injection: no fix is listed and the vendor did not respond. Restrict the admin path and bind edit_post_id in queries.
Blogbook post.php SQL injection: no fix is listed and the vendor did not respond. Restrict the site and bind the p_id value in your queries.
Blogbook user.php SQL injection: no fix is listed and the vendor did not respond. Restrict the site and bind the u_id value in your queries.
WeGIA before 3.4.5 has a Critical SQL injection in the cargo parameter of control.php. Upgrade to 3.4.5 or later and review database access and logs.
MaxKB before 1.10.9-lts and 2.0.0 has a remote command execution flaw in its MCP call, scored Medium. Upgrade to a fixed release and limit who adds tools.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
