GitHub

Products

Exploited and recent CVEs

• CVE-2026-118237 Medium 5.3 Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service 0.3%
• CVE-2026-110288 Medium 5.3 Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console 0.2%
• CVE-2026-104608 High 7.7 Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service 0.4%
• CVE-2026-96890 High 8.7 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts 0.5%
• CVE-2026-103620 Medium 6.0 Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL 0.5%
• CVE-2026-75101 Medium 6.0 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision 0.3%
• CVE-2026-77912 High 7.4 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline 0.2%
• CVE-2026-77987 Critical 9.3 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery 0.9%
• CVE-2026-76851 High 7.7 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services 0.8%
• CVE-2026-19118 High 7.7 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution 0.9%
• CVE-2026-18730 High 8.2 Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token 0.5%
• CVE-2026-18428 High 8.8 SQL Query Validation Bypass in OpenSearch Direct Query 1.0%
• CVE-2026-18952 High 8.1 Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin 0.5%
• CVE-2026-19311 High 8.1 Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin 0.6%
• CVE-2026-15996 Medium 6.6 Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters 0.8%
• CVE-2026-17556 High 8.8 Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header 0.8%
• CVE-2026-47427 High 7.5 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler 0.8%
• CVE-2026-54163 Medium 4.7 secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input 0.2%
• CVE-2026-15783 Medium 5.3 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites 0.4%
• CVE-2026-15343 High 8.6 Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths 1.2%
• CVE-2026-15007 Medium 5.7 Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration 0.6%
• CVE-2026-14340 Medium 5.3 An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories 0.4%
• CVE-2026-10585 Medium 6.3 Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category 0.3%
• CVE-2026-9132 Medium 6.0 Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint 0.4%
• CVE-2026-9106 Medium 4.8 UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen 0.4%
• CVE-2026-48529 Medium 6.0 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion 0.2%
• CVE-2026-9312 Critical 9.2 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint 9.2%
• CVE-2026-8606 High 7.0 Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint 0.5%
• CVE-2026-45033 High 8.5 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor 0.4%
• CVE-2026-8106 Medium 5.9 Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft 0.2%