Blog - Page 2 of 37 - Safe Security
SAFE Named a Leader in the 2026 Liminal Index for Cyber TPRM. Get the Report →
Book a demo

Blog

Threat Research CVE-2026-41948 Dify ≤ 1.14.1 – Unauthenticated Plugin Daemon Internal API Exposure via Path Traversal in the Console Icon Proxy 1. Introduction This document illustrates a relative path traversal vulnerability in Dify, the open-source large language model (LLM) application development platform used by more than 50,000 organisations to… SAFE Safe Security Oct 19, 2026 10 min read
Threat Research CVE-2026-45332 Automad Flat-File CMS Unauthenticated Admin Password Hash Disclosure via Broken Setup Endpoint — Offline Hash Cracking 1. Introduction This document illustrates an unauthenticated sensitive data exposure vulnerability in Automad — a modern flat-file content management system. The vulnerability, tracked as CVE-2026-45332, allows any unauthenticated… SAFE Safe Security Oct 19, 2026 9 min read
Threat Research CVE-2026-48611 phpBB Forum Software Unauthenticated Authentication Bypass via OAuth Login-Link Flow — Full Admin Takeover 1. Introduction This document illustrates a critical authentication bypass vulnerability in phpBB — the most widely deployed open-source forum software in the world, powering over 500,000 active forum… SAFE Safe Security Oct 14, 2026 9 min read
Threat Research This Week in CVEs: Exploitation Expands Across Backup, Remote Access, and Developer Infrastructure By SAFE Threat Research Team This week’s exploitation activity expanded across some of the most operationally important layers of enterprise infrastructure – from backup platforms and remote-access appliances… SAFE Safe Security Oct 13, 2026 9 min read
TPRM Third Party Breach Detection and Notifications with SAFE TPRM Your vendor passed its assessment. The questionnaire is complete, the security report is on file, and the next review is months away. Then someone forwards a breach headline… Rahul Tyagi Safe Security Oct 12, 2026 15 min read
TPRM Best Third Party Risk Management Solutions A buyer’s guide for 2026 and 2027 to what modern TPRM platforms really do, and how SAFE Security handles vendor risk from the first intake form to the… Rahul Tyagi Safe Security Oct 12, 2026 18 min read
Threat Research CVE-2026-33032 nginx-ui ≤ 2.3.3 – Unauthenticated MCP Authentication Bypass via Missing AuthRequired() Middleware on /mcp_message 1. Introduction This document illustrates an unauthenticated authentication bypass in nginx-ui, the open-source web interface used to manage Nginx web servers. The flaw lets an anonymous network client… SAFE Safe Security Oct 9, 2026 9 min read
Events Gartner UK from the Practitioner’s Seat: Everyone Wants to Be an Orchestrator. Now What? Be an orchestrator. Don’t buy, build. Automate the low-level tasks so your team can focus on the work that matters. Those are just a few of the buzzwords… Jacqueline Lebo Safe Security Oct 8, 2026 4 min read
Trends Life of a CISO in the Frontier AI Era : The Thankless Job With 24/7 Stress and What Must Change What breach cases, boardroom pressure, budget gaps and AI-enabled attacks reveal about the world’s most exposed executive role A CISO’s job can feel thankless. The organization expects continuous… Rahul Tyagi Safe Security Oct 8, 2026 18 min read
Threat Research CVE-2026-87902 WordPress: Unauthenticated Path Traversal Leading to Conditional RCE 1. Introduction CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress page-template resolution. Under specific theme and server conditions, a remote attacker can include a readable local PHP… SAFE Safe Security Oct 7, 2026 8 min read
Threat Research CVE-2026-63077 : JetBrains TeamCity On-Premises – Unauthenticated Remote Code Execution via Agent Polling Deserialization 1. Introduction This document illustrates an unauthenticated Remote Code Execution (RCE) vulnerability in JetBrains TeamCity On-Premises – the widely deployed commercial Continuous Integration and Continuous Delivery (CI/CD) server… SAFE Safe Security Oct 6, 2026 9 min read
Threat Research CVE-2026-62201 OpenClaw: Sandbox Exec-Server SSRF and Network Policy Bypass 1. Introduction This article examines a Server-Side Request Forgery (SSRF) and network policy bypass in OpenClaw, a local-first AI assistant platform that supports execution through sandboxed backends. Tracked… SAFE Safe Security Oct 5, 2026 9 min read