CVETitleExploitation statusPublicly disclosed?CVSS v3 base scoreCVE-2026-56155Active Directory Federation Services Elevation of Privilege VulnerabilityExploitation DetectedNo7.8CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege VulnerabilityExploitation DetectedNo5.3
CVETitleExploitation statusPublicly disclosed?CVSS v3 base scoreCVE-2026-50661Windows BitLocker Security Feature Bypass VulnerabilityExploitation Less LikelyYes6.1
A tool for scanning Python environments for known vulnerabilities
With the root cause identified on March, 4, 2026, at 5:45 p.m. UTC, our engineering team developed and deployed a fix to github.com at 7:00 p.m. UTC that same day. The fix ensures that user-supplied push option values are properly sanitized and can no longer influence internal metadata fields. For GitHub Enterprise Server, we prepared patches across all supported releases (3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, 3.20.0, or later) and published CVE-2026-3854. These are available today
When a user pushes code to GitHub, the operation passes through multiple internal services. As part of this process, metadata about the push, such as the repository type and the environment it should be processed in, is passed between services using an internal protocol. The vulnerability leveraged how user-supplied git push options were handled within this metadata. Push options are an intentional feature of git that allow clients to send key-value strings to the server during a push. However,
Recent npm compromises expose developers to credential theft and RCE. Learn how Shai-Hulud exploited trusted packages and what actions to take in our blog.
View the history of software supply chain attacks, open source components analyzed by Sonatype
Fix what matters. Once. aisy helps security teams turn vulnerability noise into threat models they can act on, so every finding makes the next one less likely.
COGNNA’s AI SOC platform with intelligent SOC Agents streamlines detection, response and compliance supporting SOC teams for faster, smarter security.
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation. View CVE Details Affected Products Siemens SINEC OS Vendor:Siemens Product Version:RUGGEDCOM RST2428P (6GK6242-6PA00) Product Status:known_affected Remediations Vendor fixUpdate to V4.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/110002573/ Relevant CWE: CWE-271 Privileg
PowerChute is vulnerable to improper validation of quantity‑related inputs, which can cause event and data logs to be truncated. As a result, important audit information may be lost, reducing visibility into system behavior. View CVE Details Affected Products Schneider Electric PowerChute Serial Shutdown Vendor:SuSE, Schneider Electric, Red Hat, Microsoft Product Version:SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4 Product Status:known_affected Remediations
The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process. View CVE Details Affected Products Labcenter Proteus 9 Vendor:Labcenter Electronics Product Version:Labcenter Electronics Proteus: 9.1_SP4_Build_42914 Product Status:known_affected Remediations Vendor fixLabcenter recommends ensuring you are using the latest
Expand All + CVE-2026-20744 The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation. View CVE Details Affected Products Hydro-Québec Le Circuit Electrique charging station backend Vendor:Hydro-Québec Product Version:Hydro-Québec Le Circuit Electrique charging station backend:
A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages. View CVE Details Affected Products Digi International PortServer TS, Digi One SP IA Vendor:Digi International Product Version:Digi International PortSer
Expand All + CVE-2026-13768 Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network. View CVE Details Affected Products Gardyn IoT Hub V
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it. View CVE Details Affected Products OFFIS DCMTK Toolkit Vendor:OFFIS Product Version:OFFIS DCMTK: <=3.7.0 Product Status:known_affected Remediations MitigationThe maintainer was notified of these vulnerab
VirusTotal
Talk to 1Password's sales team to learn how SaaS Manager can help you discover, secure, and manage access to all your SaaS apps – managed and unmanaged – in one tool.
CORTEX