GitHub Enterprise Server

• CVE-2026-118237 Medium 5.3 Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service 0.3%
• CVE-2026-110288 Medium 5.3 Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console 0.2%
• CVE-2026-104608 High 7.7 Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service 0.4%
• CVE-2026-96890 High 8.7 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts 0.5%
• CVE-2026-103620 Medium 6.0 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL 0.5%
• CVE-2026-75101 Medium 6.0 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision 0.3%
• CVE-2026-77912 High 7.4 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline 0.2%
• CVE-2026-77987 Critical 9.3 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery 0.9%
• CVE-2026-76851 High 7.7 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services 0.8%
• CVE-2026-19118 High 7.7 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution 0.9%
• CVE-2026-18730 High 8.2 Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token 0.5%
• CVE-2026-15996 Medium 6.6 Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters 0.8%
• CVE-2026-17556 High 8.8 Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header 0.8%
• CVE-2026-15783 Medium 5.3 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites 0.4%
• CVE-2026-15343 High 8.6 Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths 1.2%
• CVE-2026-15007 Medium 5.7 Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration 0.6%
• CVE-2026-14340 Medium 5.3 An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories 0.4%
• CVE-2026-10585 Medium 6.3 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category 0.3%
• CVE-2026-9132 Medium 6.0 Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint 0.4%
• CVE-2026-9106 Medium 4.8 UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen 0.4%
• CVE-2026-9312 Critical 9.2 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint 9.2%
• CVE-2026-8606 High 7.0 Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint 0.5%
• CVE-2026-8106 Medium 5.9 Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft 0.2%
• CVE-2026-8034 High 7.9 Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion 0.5%
• CVE-2026-7541 Medium 6.3 Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint 0.4%
• CVE-2026-6736 Medium 6.3 Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider 0.3%
• CVE-2026-5845 High 7.2 Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server 0.3%
• CVE-2026-3307 Medium 5.3 Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers 0.3%
• CVE-2026-5512 Medium 5.3 Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API 0.3%
• CVE-2026-4296 High 7.5 Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass 0.4%
• CVE-2026-5921 High 8.9 Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack 0.4%
• CVE-2026-3582 Medium 5.3 Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope 0.3%
• CVE-2026-2266 High 7.4 Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection 0.2%
• CVE-2026-3306 Medium 5.3 Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access 0.4%
• CVE-2026-3854 High 8.7 Remote code execution via git push option injection in GitHub Enterprise Server 41.9%
• CVE-2026-1999 High 7.1 Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests 0.4%
• CVE-2026-1355 Medium 6.0 Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports 0.5%
• CVE-2026-0573 High 7.6 Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution 0.7%
• CVE-2025-13744 High 8.4 Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML 0.2%
• CVE-2025-14046 High 8.6 Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests 0.4%
• CVE-2025-11578 High 7.5 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation 0.7%
• CVE-2025-11892 High 8.6 DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers 0.7%
• CVE-2025-8447 High 7.0 Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access 0.3%
• CVE-2025-6981 Medium 5.3 Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access 0.3%
• CVE-2025-3509 High 7.1 Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation 1.3%
• CVE-2025-3124 Medium 5.3 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names 0.4%
• CVE-2024-10001 High 7.1 Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling 0.4%
• CVE-2025-23369 High 7.6 Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation 1.6%
• CVE-2024-8810 High 8.7 Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access 0.4%
• CVE-2024-10824 Medium 6.0 Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data 0.3%