Featured Posts
All Posts

Security
Apr 27, 2026
CVE-2026-40976: Spring Boot 4.0 Actuator Authorization Bypass
How a missing dependency on spring-boot-health silently disables the default web security filter chain
Greg Allen

Security
Apr 27, 2026
Announcing NES for Ingress NGINX, resolving CVE-2026-32282
How to secure Kubernetes ingress after Ingress NGINX EOL—without forcing immediate platform migration.
Hayden Barnes

Security
Apr 27, 2026
Spring CVEs Surge in 2026: 30 Vulnerabilities in Two Months
Why the rapid increase in Spring vulnerabilities is changing patch timelines—and exposing teams running unsupported versions.
Bob McNees

Security
Apr 24, 2026
CVE-2026-41423: SSRF in Angular Platform-Server via Backslash URL Normalization
How a single malformed request URL hijacks Angular SSR's origin resolution and redirects server-side HTTP requests to attacker-controlled infrastructure
George Kalpakas

Security
Apr 24, 2026
Drupal 7 Security Roundup: Eight CVEs Resolved in Contrib Modules (April 2026)
OpenID Connect, Protected Pages, CAPTCHA, and five more: what changed, who is affected, and what Drupal 7 sites on end-of-life support need to know
Javier Perez

Products
Apr 23, 2026
Security Is the New Quality: Why Product Managers Must Own Vulnerability Risk
A perspective on the changing responsibilities of product leadership
Mark Szymanski

Security
Apr 23, 2026
Express 3 is EOL, Express 4 is Next: The 2026 Support Reference
A reference for Express support timelines, and what end-of-life means for organizations still running older versions in production.
Javier Perez

Security
Apr 22, 2026
CVE-2026-26171: .NET EncryptedXml DoS Vulnerability Explained and How to Fix It
Why this XML-based DoS vulnerability creates immediate risk for EOL .NET systems—and what your remediation options are.
Hayden Barnes

Security
Apr 22, 2026
CVE-2026-32178: SMTP Injection in .NET's System.Net.Mail Leaves .NET 6 Without a Patch
A high-severity spoofing and SMTP command injection vulnerability disclosed in April 2026's Patch Tuesday affects .NET's email handling stack.
Hayden Barnes

Products
Apr 22, 2026
Announcing NES for .NET Containers
Why containerized .NET apps remain vulnerable after EOL—and how NES provides a secure bridge while you migrate.
Hayden Barnes

Security
Apr 21, 2026
How Does My Scanner See HeroDevs? Trivy Edition
Why Snyk still flags vulnerabilities after NES—and how to correctly suppress false positives with a .snyk policy file.
JD Flynn

Security
Apr 21, 2026
The Realities of Upgrading: What You Need to Know Before Migrating from End-of-Life Angular 18
Why upgrading from Angular 18 isn’t a simple version bump—and what enterprises must plan for across testing, dependencies, and security.
Javier Perez

Security
Apr 21, 2026
Knockout.js End of Life: Security Risks for DNN and .NET Teams
Why Knockout.js has become a hidden security liability for DNN and .NET teams—and what to do before your next audit.
Greg Allen

Security
Apr 20, 2026
Angular Supported Node.js Versions: The Complete Compatibility Matrix
The definitive Angular-to-Node.js compatibility guide—and why outdated pairings create a double layer of security risk.
Greg Allen

Products
Apr 20, 2026
What Your Scanner Isn’t Telling You About EOL Risk
Why CVE-based scanning falls short—and how EOL software creates invisible risk across your dependency tree.
Parin Shah


