Github vulnerabilities

Products

• Enterprise Server 126
• Enterprise Server 92
• Enterprise Server 46
• Cmark-gfm 11
• Github 9
• View Component 6
• Cli 4
• Github-mcp-server 3
• Opensearch 3
• Codeql-action 2
• Copilot-cli 2

Newest

• github enterprise server Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts CVE-2026-96890 8.7 HighOctober 6, 2026
• github enterprise server Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL CVE-2026-103620 6.0 MediumOctober 6, 2026
• 0xshariq github-mcp-server 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection CVE-2026-102906 5.3 MediumSeptember 30, 2026
• github enterprise server Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision CVE-2026-75101 6.0 MediumSeptember 22, 2026
• github enterprise server Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline CVE-2026-77912 7.4 HighSeptember 22, 2026
• github enterprise server GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery CVE-2026-77987 9.3 CriticalSeptember 22, 2026
• github enterprise server Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services CVE-2026-76851 7.7 HighSeptember 1, 2026
• github enterprise server Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution CVE-2026-19118 7.7 HighSeptember 1, 2026
• github enterprise server Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token CVE-2026-18730 8.2 HighSeptember 1, 2026
• aws opensearch SQL Query Validation Bypass in OpenSearch Direct Query CVE-2026-18428 8.7 HighAugust 13, 2026
• aws opensearch Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin CVE-2026-18952 8.6 HighAugust 12, 2026
• aws opensearch Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin CVE-2026-19311 8.6 HighAugust 12, 2026
• github enterprise server Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters CVE-2026-15996 6.6 MediumAugust 5, 2026
• github enterprise server Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header CVE-2026-17556 8.8 HighAugust 5, 2026
• github mcp server, github-mcp-server +1 more GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler CVE-2026-47427 Fix available 7.5 HighJuly 28, 2026
• github enterprise server Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites CVE-2026-15783 5.3 MediumJuly 17, 2026
• github enterprise server Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths CVE-2026-15343 8.6 HighJuly 17, 2026
• github enterprise server Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration CVE-2026-15007 5.7 MediumJuly 17, 2026
• github view component view_component: Reused Component Instances Retain Stale Render Context CVE-2026-54497 Fix available 6.8 MediumJuly 15, 2026
• github view component view_component: around_render HTML-Safety Bypass CVE-2026-54498 Fix available 8.7 HighJuly 15, 2026
• github secure headers secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input CVE-2026-54163 Fix available 4.7 MediumJuly 10, 2026
• github enterprise server An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories CVE-2026-14340 5.3 MediumJuly 1, 2026
• github enterprise server Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category CVE-2026-10585 6.3 MediumJune 30, 2026
• github enterprise server Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint CVE-2026-9132 6.0 MediumJune 30, 2026
• github enterprise server UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen CVE-2026-9106 4.8 MediumJune 30, 2026
• github github-mcp-server GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion CVE-2026-48529 Fix available 6.0 MediumJune 25, 2026
• cli GitHub CLI tokens leak via `gh attestation` commands CVE-2026-48501 Fix available 7.4 HighMay 29, 2026
• github enterprise server Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint CVE-2026-9312 9.2 CriticalMay 27, 2026
• github enterprise server Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint CVE-2026-8606 7.0 HighMay 26, 2026
• cli gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection CVE-2026-45803 Fix available 3.5 LowMay 15, 2026
• github copilot-cli GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor CVE-2026-45033 Public exploitFix available 8.5 HighMay 11, 2026
• github view component view_component: System Test Entry Point Path Check Allows Sibling Directory Escape CVE-2026-44837 Fix available 5.9 MediumMay 8, 2026
• github view component view_component: Preview Route Can Dispatch Inherited Helper Methods CVE-2026-44836 Fix available 6.5 MediumMay 8, 2026
• github enterprise server Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft CVE-2026-8106 5.9 MediumMay 7, 2026
• github enterprise server Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion CVE-2026-8034 7.9 HighMay 7, 2026
• github enterprise server Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint CVE-2026-7541 6.3 MediumMay 7, 2026
• github enterprise server Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider CVE-2026-6736 6.3 MediumMay 7, 2026
• github enterprise server Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server CVE-2026-5845 7.2 HighApril 21, 2026
• github enterprise server Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers CVE-2026-3307 5.3 MediumApril 21, 2026
• github enterprise server Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API CVE-2026-5512 5.3 MediumApril 21, 2026
• github enterprise server Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass CVE-2026-4296 7.5 HighApril 21, 2026
• github enterprise server Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack CVE-2026-5921 8.9 HighApril 21, 2026
• github enterprise server Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope CVE-2026-3582 5.3 MediumMarch 10, 2026
• github enterprise server Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection CVE-2026-2266 7.4 HighMarch 10, 2026
• github enterprise server Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access CVE-2026-3306 Public exploit 5.3 MediumMarch 10, 2026
• github enterprise server Remote code execution via git push option injection in GitHub Enterprise Server CVE-2026-3854 Public exploit EPSS 39.8% 8.7 HighMarch 10, 2026
• github copilot-cli, copilot command line interface +1 more GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution CVE-2026-29783 Fix available 7.5 HighMarch 6, 2026
• github webiness inventory Webiness Inventory 2.3 SQL Injection via WsModelGrid.php CVE-2018-25188 8.8 HighMarch 6, 2026
• github enterprise server Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests CVE-2026-1999 Public exploit 7.1 HighFebruary 18, 2026
• github enterprise server Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports CVE-2026-1355 6.0 MediumFebruary 18, 2026
• Show olderLoading…