Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
e-Diary Management System 1.0 has SQL injection in add-category.php (CVSS 7.3). No fix is named in the record, so restrict access and fix the query.
JS Job Manager (js-jobs) for WordPress through 2.0.2 has a critical SQL injection, CVSS 9.3. Update to a patched release or remove the plugin.
Old Age Home Management System 1.0 has SQL injection in search.php (CVSS 7.3). No fix is named in the record, so restrict access and fix the query.
admintwo 1.0 by xujiangfei has a server-side request forgery in /resource/add through the description argument (CVSS 6.3). No fix named; restrict access.
IDonate for WordPress up to 2.1.18 has a PHP local file inclusion flaw (CVSS 8.1). Update to a fixed version, or remove the plugin if none is available.
TOTOLINK A6000R firmware 1.0.1-B20201211.2000 has command injection in apcli_cancel_wps (CVSS 6.3). No fix named; limit access and check for firmware.
GraphicsMagick before commit 8e56520 has a heap buffer over-read in ReadJXLImage (CVSS 4.0). Update through your distribution or build from a newer source.
Library Management System 1.0 has SQL injection in Forgot.java (CVSS 6.3). No fix is named in the record, so restrict access and fix the query.
vLLM 0.6.5 to before 0.8.5 with the Mooncake integration deserializes pickle over open ZeroMQ sockets (CVSS 10.0 RCE). Upgrade to 0.8.5 and restrict ports.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
