Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Chimpstudio FoodBakery (wp-foodbakery) through 3.3 deserializes untrusted data, a CVSS 9.8 PHP object injection. Update to a fixed release or remove it.
SUMO Reward Points for WordPress through 30.7.0 has a PHP local file inclusion flaw (CVSS 8.3). Update to a fixed release or remove the plugin.
conda-build before 25.3.0 listed conda-index, not published on PyPI, as a dependency, so someone could claim the name. Upgrade to 25.3.0 or later.
conda-build before 25.4.0 does not sanitize tar entry paths, allowing files to be written outside the extraction folder (CVSS 9.8). Upgrade to 25.4.0.
conda-build before 25.4.0 uses eval on recipe selectors in meta.yaml, allowing code execution during builds (CVSS 9.8). Upgrade to 25.4.0 or later.
SQLite concat_ws() can overflow a 32-bit size and trigger a heap overflow of about 4GB (CVSS 9.8). Update SQLite and find bundled copies in your stack.
qinguoyi TinyWebServer up to 1.0 has an improper authentication flaw in http_conn.cpp via m_url_real (CVSS 5.3). No fix named; restrict access to it.
JS Job Manager (js-jobs) for WordPress through 2.0.2 allows unrestricted file upload, a CVSS 10.0 web shell risk. Update the plugin or remove it.
qinguoyi TinyWebServer up to 1.0 has a stack buffer overflow in http_conn.cpp via the name and password fields (CVSS 7.3). No fix named; do not expose it.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
