Skip to contentGithub vulnerabilities
Newest
- github enterprise serverImproper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code executionCVE-2026-05737.6 High
- github enterprise serverImproper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLCVE-2025-137448.4 High
- github enterprise serverInsufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsCVE-2025-140468.6 High
- github enterprise serverPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationCVE-2025-115787.5 High
- github enterprise serverDOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggersCVE-2025-118928.6 High
- github enterprise serverIncorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only accessCVE-2025-84477.0 High
- fastly h20, github enterprise server, linux +16 more +18 moreCVE-2025-8671CVE-2025-8671Public exploitFix available7.5 High
- github enterprise serverIncorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only accessCVE-2025-69815.3 Medium
- github enterprise serverGitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search APICVE-2025-66006.3 Medium
- github enterprise serverMarkdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggersCVE-2025-32468.6 High
- github enterprise serverPre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege EscalationCVE-2025-35097.1 High
- github enterprise serverMissing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository namesCVE-2025-31245.3 Medium
- github enterprise serverCode Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message HandlingCVE-2024-100017.1 High
- github codeql-actionCodeQL GitHub Action failed workflow writes GitHub PAT to debug artifactsCVE-2025-24362Fix available7.1 High
- github enterprise serverImproper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper ValidationCVE-2025-23369Public exploit7.6 High
- cliRecursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cliCVE-2024-53858Fix available6.5 Medium
- cli go-ghgo-gh `auth.TokenForHost` violates GitHub host security boundary within a codespaceCVE-2024-53859Fix available6.5 Medium
- cliConnecting to a malicious Codespaces via GH CLI could allow command execution on the user's computerCVE-2024-52308Fix available8.0 High
- github enterprise serverPrivilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write accessCVE-2024-88108.7 High
- github enterprise serverAuthorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert DataCVE-2024-108246.0 Medium
- github enterprise serverPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationCVE-2024-100078.7 High
- github enterprise serverAn information disclosure vulnerability was identified in GitHub Enterprise Server via attacker...CVE-2024-95395.7 Medium
- github enterprise serverAn Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature w…CVE-2024-9487EPSS 25.6%9.5 Critical
- github enterprise serverAn improper privilege management vulnerability allowed arbitrary workflows to be committed using...CVE-2024-82636.2 Medium
- github enterprise serverA Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of...CVE-2024-87705.8 Medium
- actions toolkit, github actions\/artifact, actions toolkit +2 moreArbitrary File Write via artifact extraction in actions/artifactCVE-2024-42471Public exploitFix available7.3 High
- github enterprise serverAn XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when...CVE-2024-68009.5 Critical
- github enterprise serverIncorrect Authorization allows read access to issues in GitHub Enterprise ServerCVE-2024-63375.9 Medium
- github enterprise serverAn Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an...CVE-2024-77115.3 Medium
- github enterprise serverGitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy KeysCVE-2024-63956.3 Medium
- github enterprise serverSecurity misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposureCVE-2024-63366.9 Medium
- github enterprise serverImproper authorization allows read access to issue content in GitHub Enterprise ServerCVE-2024-58175.9 Medium
- github enterprise serverImproper authorization allows persistent access in GitHub Enterprise ServerCVE-2024-58166.9 Medium
- github enterprise serverCross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repositoryCVE-2024-58156.8 Medium
- github enterprise serverDenial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustionCVE-2024-57957.7 High
- github enterprise serverImproper Privilege Management allows for access to unauthorized repository content during migrationCVE-2024-55665.8 Medium
- github enterprise serverA Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that...CVE-2024-57467.6 High
- github enterprise serverAn authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when...CVE-2024-498510.0 Critical
- github enterprise serverRace Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissionsCVE-2024-24405.5 Medium
- github enterprise serverImproper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleCVE-2024-36848.0 High
- github enterprise serverCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleCVE-2024-36468.0 High
- github enterprise serverRepository administrator can bypass organization's ruleset using deploy keysCVE-2024-34705.9 Medium
- github enterprise serverCSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a userCVE-2024-27484.3 Medium
- github enterprise serverImproper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleCVE-2024-24439.1 Critical
- github enterprise serverRemote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the applianceCVE-2024-24698.0 High
- github enterprise serverImproper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege EscalationCVE-2024-19086.3 Medium
- github codeql cli, codeql-cli-binaries +1 moreLimited data exfiltration in CodeQL CLICVE-2024-251292.7 Low
- github enterprise serverImproper Authorization in GitHub Enterprise Server allowed unauthorized workflow executionCVE-2024-14827.1 High
- github enterprise serverCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement ConsoleCVE-2024-13789.1 Critical
- github enterprise serverCommand injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement ConsoleCVE-2024-13749.1 Critical
- Show moreLoading…