Github Enterprise Server vulnerabilities

• github enterprise server Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service CVE-2026-118237 5.3 MediumNovember 3, 2026
• github enterprise server Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console CVE-2026-110288 5.3 MediumNovember 3, 2026
• github enterprise server Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service CVE-2026-104608 7.7 HighNovember 3, 2026
• github enterprise server Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts CVE-2026-96890 8.7 HighOctober 6, 2026
• github enterprise server Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL CVE-2026-103620 6.0 MediumOctober 6, 2026
• github enterprise server Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision CVE-2026-75101 6.0 MediumSeptember 22, 2026
• github enterprise server Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline CVE-2026-77912 7.4 HighSeptember 22, 2026
• github enterprise server GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery CVE-2026-77987 9.3 CriticalSeptember 22, 2026
• github enterprise server Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services CVE-2026-76851 7.7 HighSeptember 1, 2026
• github enterprise server Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution CVE-2026-19118 7.7 HighSeptember 1, 2026
• github enterprise server Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token CVE-2026-18730 8.2 HighSeptember 1, 2026
• github enterprise server Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters CVE-2026-15996 6.6 MediumAugust 5, 2026
• github enterprise server Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header CVE-2026-17556 8.8 HighAugust 5, 2026
• github enterprise server Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites CVE-2026-15783 5.3 MediumJuly 17, 2026
• github enterprise server Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths CVE-2026-15343 8.6 HighJuly 17, 2026
• github enterprise server Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration CVE-2026-15007 5.7 MediumJuly 17, 2026
• github enterprise server An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories CVE-2026-14340 5.3 MediumJuly 1, 2026
• github enterprise server Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category CVE-2026-10585 6.3 MediumJune 30, 2026
• github enterprise server Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint CVE-2026-9132 6.0 MediumJune 30, 2026
• github enterprise server UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen CVE-2026-9106 4.8 MediumJune 30, 2026
• github enterprise server Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint CVE-2026-9312 9.2 CriticalMay 27, 2026
• github enterprise server Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint CVE-2026-8606 7.0 HighMay 26, 2026
• github enterprise server Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft CVE-2026-8106 5.9 MediumMay 7, 2026
• github enterprise server Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion CVE-2026-8034 7.9 HighMay 7, 2026
• github enterprise server Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint CVE-2026-7541 6.3 MediumMay 7, 2026
• github enterprise server Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider CVE-2026-6736 6.3 MediumMay 7, 2026
• github enterprise server Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server CVE-2026-5845 7.2 HighApril 21, 2026
• github enterprise server Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers CVE-2026-3307 5.3 MediumApril 21, 2026
• github enterprise server Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API CVE-2026-5512 5.3 MediumApril 21, 2026
• github enterprise server Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass CVE-2026-4296 7.5 HighApril 21, 2026
• github enterprise server Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack CVE-2026-5921 8.9 HighApril 21, 2026
• github enterprise server Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope CVE-2026-3582 5.3 MediumMarch 10, 2026
• github enterprise server Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection CVE-2026-2266 7.4 HighMarch 10, 2026
• github enterprise server Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access CVE-2026-3306 Public exploit 5.3 MediumMarch 10, 2026
• github enterprise server Remote code execution via git push option injection in GitHub Enterprise Server CVE-2026-3854 Public exploit EPSS 39.8% 8.7 HighMarch 10, 2026
• github enterprise server Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests CVE-2026-1999 Public exploit 7.1 HighFebruary 18, 2026
• github enterprise server Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports CVE-2026-1355 6.0 MediumFebruary 18, 2026
• github enterprise server Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution CVE-2026-0573 7.6 HighFebruary 18, 2026
• github enterprise server Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML CVE-2025-13744 8.4 HighJanuary 6, 2026
• github enterprise server Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests CVE-2025-14046 8.6 HighDecember 11, 2025
• github enterprise server Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation CVE-2025-11578 7.5 HighNovember 10, 2025
• github enterprise server DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers CVE-2025-11892 8.6 HighNovember 10, 2025
• github enterprise server Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access CVE-2025-8447 7.0 HighAugust 26, 2025
• fastly h20, github enterprise server, linux +16 more +18 more CVE-2025-8671 CVE-2025-8671 Public exploitFix available 7.5 HighAugust 13, 2025
• github enterprise server Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access CVE-2025-6981 5.3 MediumJuly 15, 2025
• github enterprise server GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API CVE-2025-6600 6.3 MediumJuly 1, 2025
• github enterprise server Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers CVE-2025-3246 8.6 HighApril 17, 2025
• github enterprise server Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation CVE-2025-3509 7.1 HighApril 17, 2025
• github enterprise server Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names CVE-2025-3124 5.3 MediumApril 17, 2025
• github enterprise server Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling CVE-2024-10001 7.1 HighJanuary 29, 2025
• Show olderLoading…