Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Smartbedded Meteobridge's CGI-shell-script web interface lets a remote unauthenticated attacker execute arbitrary commands as root, a legacy embedded architecture problem still live in 2026.
CVE-2025-54068 lets unauthenticated attackers achieve remote command execution in Laravel Livewire v3 through how component property updates are hydrated, with no known workaround.
A directory traversal bug in Trend Micro Apex One and a four-year-old SSRF flaw in Omnissa Workspace ONE UEM both use management-plane trust against the fleets these tools are meant to protect.
Infrastructure management and managed file transfer software rarely share a vulnerability post, but both HPE OneView and Fortra GoAnywhere MFT scored a maximum CVSS 10.0 for unauthenticated RCE.
A live npm registry attack against TanStack's trusted GitHub Actions publishing pipeline and a years-old ASUS Live Update client backdoor show two distinct ways software trust gets weaponized.
A 2025 command injection bug in FreePBX's Endpoint Manager and a 2019 authentication bypass landed in KEV together, additional findings beyond FreePBX coverage published elsewhere in this series.
Three confirmed-exploited Gladinet vulnerabilities that NVD itself says can be chained together into full system compromise across CentreStack and Triofox.
Two authentication bypasses and a path traversal bug all target Kentico Xperience's Staging Sync Server, chaining into a documented pre-authentication remote code execution path.
An unauthenticated eval injection in XWiki, a known-username command injection in Control Web Panel, and a file-upload RCE in an anti-ransomware tool itself — three vendors, one lesson.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
