Featured Posts

Security

May 7, 2026

Spring Boot April 2026: 8 CVEs Including CVE-2026-40976 Critical

How a single April 23 release fixed eight Spring Boot vulnerabilities, dominated by auto-configuration paths that silently weakened production security

Security

May 7, 2026

Log4j 2.17.x: Five Unpatched CVEs Now Resolved with NES for Apache Log4j 2

HeroDevs releases a drop-in replacement for Log4j 2.17.x patching two TLS hostname verification bypasses and three log pipeline vulnerabilities with no upstream fix available.

EOL Software

May 7, 2026

The Q2 2026 EOL Survival Guide: MySQL, Node 20, Django, Angular, Spring

Five major frameworks. Ninety days. Your survival guide to the most concentrated open source EOL wave in history.

Security

May 6, 2026

CVE-2026-22752: Spring Authorization Server Critical — XSS, SSRF, and Privilege Escalation

How a flaw in dynamic client registration exposes OAuth servers to XSS, SSRF, and token abuse.

Compliance

May 5, 2026

EOL Open Source Is Now a CRA Compliance Problem. Most Teams Don't Know Which Components They're Exposed On.

September 11, 2026 is when manufacturer reporting obligations begin. December 11, 2027 is full enforcement. Here is what each deadline actually requires — and what EOL open source components mean for your compliance posture before both dates arrive.

Security

May 4, 2026

CVE-2025-24813: Remote Code Execution in Apache Tomcat via Partial PUT Path Equivalence

How a path equivalence flaw in the default servlet exposed Apache Tomcat to unauthenticated RCE, information disclosure, and file injection, and why it is now in CISA's Known Exploited Vulnerabilities catalog

Security

Apr 30, 2026

CVE-2026-1207: SQL Injection in Django Raster Lookups (PostGIS)

How a missed parameterization in PostGIS raster band index lookups exposes every Django version, including the unevaluated EOL ones

Compliance

Apr 30, 2026

Introducing EOLDS: See Every EOL Dependency in Your Stack

Find every end-of-life dependency before your auditor does—and fix the risks your scanner can’t see.

Security

Apr 29, 2026

Application Security in 2026: Why Old jQuery CVEs Still Dominate Codebases

Vulnerabilities are not new, yet they persist because organizations fail to patch or migrate away from outdated versions.

Security

Apr 28, 2026

5 Spring AI CVEs Disclosed April 27, 2026: Roundup and EOL Risk

Vector store injection, cross-tenant memory exfiltration, and a tighter Spring Boot 3.5 EOL window for Spring AI teams

Migration

Apr 28, 2026

Axios Versions, CVEs, and Safe Upgrade Path (Updated April 2026)

A complete, version-by-version reference for the most widely deployed HTTP client in JavaScript, including CVE coverage, fix versions, and the support gap that catches enterprises off guard.

EOL Software

Apr 28, 2026

Node.js v20 EOL is Here: What actually happens to your apps on May 1

The deadline is Thursday. Here is a concrete, operations-level breakdown of what changes for Node.js v20 applications starting May 1.

Security

Apr 27, 2026

CVE-2026-40976: Spring Boot 4.0 Actuator Authorization Bypass

How a missing dependency on spring-boot-health silently disables the default web security filter chain

Security

Apr 27, 2026

Announcing NES for Ingress NGINX, resolving CVE-2026-32282

How to secure Kubernetes ingress after Ingress NGINX EOL—without forcing immediate platform migration.

Security

Apr 27, 2026

Spring CVEs Surge in 2026: 37 Vulnerabilities in Two Months

Why the rapid increase in Spring vulnerabilities is changing patch timelines—and exposing teams running unsupported versions.