Vulnerability Analysis
Alibaba fastjson deserialization RCE (CVE-2022-25845)
A critical AutoType-bypass RCE in Alibaba fastjson (CVSS 9.8, EPSS ~99th pct) hits any app parsing untrusted JSON. Here's how to detect and fix it.
Jan 11, 20267 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedVulnerability Analysis
Struts2 REST plugin XStream deserialization RCE (CVE-2017-9805)
CVE-2017-9805 lets attackers RCE Struts2 REST APIs via unsafe XStream XML deserialization. Learn impact, affected versions, and remediation steps.
Jan 11, 20267 min read
Vulnerability Analysis
Apache Commons Collections deserialization gadget RCE (CVE-2015-7501)
A decade-old Apache Commons Collections deserialization gadget chain still enables unauthenticated RCE across legacy Java middleware. Here's how to find and fix it.
Jan 11, 20268 min read
Vulnerability Analysis
GitLab ExifTool RCE (CVE-2021-22205)
CVE-2021-22205 let attackers RCE self-managed GitLab via a malicious ExifTool-parsed upload — no auth required. Here's the timeline and fix.
Jan 11, 20268 min read
Vulnerability Analysis
OpenSSL BN_mod_sqrt infinite loop DoS (CVE-2022-0778)
CVE-2022-0778 lets attackers hang OpenSSL with a single malformed certificate. Here's the impact, affected versions, and how to remediate fast.
Jan 10, 20267 min read
Vulnerability Analysis
Dirty COW Linux kernel privilege escalation (CVE-2016-5195)
Dirty COW (CVE-2016-5195) let local attackers hijack a kernel race condition for root. Nine years old, still found in fleets — here's how to find and fix it.
Jan 10, 20268 min read
Vulnerability Analysis
Dirty Pipe Linux kernel arbitrary write (CVE-2022-0847)
Dirty Pipe (CVE-2022-0847) lets local attackers overwrite read-only files via a pipe buffer flaw, enabling fast, reliable root escalation on Linux and Android.
Jan 10, 20268 min read
Vulnerability Analysis
Follina (CVE-2022-30190): The Microsoft Zero-Day That Bypassed Macro Protections
A Word document, no macros enabled, and full remote code execution. Follina exploited the Microsoft Support Diagnostic Tool via ms-msdt protocol handlers, rendering years of macro-blocking defenses irrelevant.
Jan 10, 20267 min read
Vulnerability Analysis
Confluence Zero-Day (CVE-2022-26134): Atlassian's OGNL Injection Crisis
An unauthenticated RCE zero-day in Confluence Server was being actively exploited before Atlassian even knew about it. The vulnerability affected virtually every on-premise Confluence installation.
Jan 9, 20265 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.