Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Ark Theme Core before 1.71.0 allows unauthenticated code injection rated 10.0 by Patchstack as remote code execution. Update the plugin to 1.71.0 or later.
IBM Cognos Command Center 10.2.4.1 and 10.2.5 has an open redirect usable for phishing. Check IBM's security bulletin for the fix and apply it.
nossrf before 1.0.4 can be fooled by a hostname that resolves to a local or reserved IP address. Upgrade the npm package to 1.0.4 or later and retest it.
Hide My WP Ghost 5.4.01 and earlier has a local file inclusion flaw that Patchstack says can reach code execution. Update the plugin to 5.4.02 or later.
Yii2 up to 2.0.39 has a reported deserialization weakness in PHPUnit MockClass. No fix is named, so check your versions and dev dependencies.
Yii2 up to 2.0.45 has a reported deserialization weakness in a Symfony Finder iterator. No fix is named, so check Yii advisories and your code paths.
PHPGurukul eLearning System 1.0 has an unrestricted file upload in the user image handler. No fix is named, so restrict uploads and check the vendor site.
DESCOR INFOCAD 3.5.1 and earlier has a broken authorization schema scored 10.0. The record says 3.5.2.0 fixes it, so upgrade and restrict network access.
DESCOR INFOCAD 3.5.1 and earlier allows SQL injection, rated 10.0. The record says it is fixed in 3.5.2.0, so upgrade and read the vendor changelog.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
