Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2022-50591 chains an auth bypass with SQL injection in Advantech iView and can expose clear text passwords. Upgrade to 5.7.04 build 6425 or newer.
CVE-2022-50589 is a critical SQL injection in the SuiteCRM export feature, fixed in 7.12.6. Check your version and upgrade past 7.12.6 without delay.
Hazelcast fixed a critical member memory read (CVE-2026-107726) and a Predicates API authorization bypass (CVE-2026-107725) in March and May, and disclosed them in October. What changed in the code, the configuration you still need, and why scanners miss Enterprise builds and flag fixed ones.
Two 2023 CISA advisories covered hardcoded credentials in an installer app and command injection in a home energy gateway. What equipment makers can take from them.
CISA's February 2026 advisory on a charging platform shows how an unauthenticated OCPP endpoint lets an attacker impersonate a charger. The design lessons apply to any connected equipment backend.
CISA's 13 Oct 2026 advisory covers an authorization flaw in Inductive Automation Ignition that could give code execution in the Gateway. Fixed in 8.1.55 and 8.3.9.
CISA's 8 Oct 2026 advisory lists seven flaws in industrial Ethernet switches, including unauthenticated SNMP admin actions and unauthenticated firmware changes. Fixed in 3.11.1.
CVE-2026-9874 is a critical use-after-free in Chrome's Dawn component (CVSS 9.6) that could allow a sandbox escape. Update Chrome to 148.0.7778.216+.
CVE-2026-9813 is an SSRF (CVSS 9.9) in FlowIntel up to 3.3.0 via the external reference URL probe. Update to a build with the fix commit and limit egress.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
