Learn how SonarQube detected a Cross-Site Scripting (XSS) vulnerability in Grafana, a popular open-source data observability platform.

The popularity of the Rust programming language is growing. Rustaceans have been asking for SonarQube to support Rust and now it's here!

Sonar recently introduced new architecture as code functionality in SonarQube. With it, you can now formally define the architecture of your projects and SonarQube will automatically verify when code strays from your defined architecture preventing architectural drift.

The new SonarQube Server 2025 Release 2 contains significant enhancements across code quality, code security, and issue remediation with AI CodeFix.

In this second part, we delve into JumpServer's code execution vulnerabilities we discovered, and understand their root causes. Learn the importance of threat modeling and adherence to best practices can safeguard your own applications.

Bastion host offers a centralized point of access and control to an internal network, but what happens when this gateway itself is compromised? In this blog series, we will dive into vulnerabilities we found in JumpServer.

SonarQube Server has been honored with a 2025 DEVIES Award, recognizing its commitment to delivering a top-tier code quality and security solution for developers and organizations worldwide.

Sonar can help you keep your AI-generated code from GitHub Copilot up to snuff - here’s how!

What does the future of software development look like? Sonar's Harry Wang, VP of Growth & New Ventures, shares his expert insights.

A new Long-Term Active (LTA) version of SonarQube Server represents a significant amount of work. Since the last LTA release (version 9.9 in February 2023), thousands of development tickets have been merged into SonarQube Server and its underlying components. This includes new features, improvements to existing functionalities, and bug fixes.

SonarQube Cloud detected an arbitrary file upload in Voyager, tracked as CVE-2024-55417. When combined with other vulnerabilities our research team found, attackers can execute arbitrary code on the server if an authenticated user clicks on a link.

Our Vulnerability Research team looks back at a great year and summarizes the highlights of 2024.

Reviewing the enhancements delivered by the SonarQube for IDE team for developers during 2024. Focusing on streamlining the UX for teams, harnessing the power of SonarQube Server and Cloud through connected mode into your IDE, and making it even easier to focus on new code.

CORS misconfigurations are often overlooked, but they can have severe consequences. We demonstrate how reflecting the origin header leads to code execution in Whistle.

Announcing a new free tier of SonarQube, hosted in the cloud. This tier goes beyond our current community offering and gives individual developers and small teams many of the features of our commercial SonarQube offering.