Enterprise Server (Github) - vulnerabilities (CVEs)

126 CVEs, 2 in the last 30 days, 994 known versions, newest CVE from 2026-10-06. Vendor: Github.

CVEs of Enterprise Server

CVE-2026-96890 - CVSS 8.8 (high), 2026-10-06: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to…
CVE-2026-103620 - CVSS 6.5 (medium), 2026-10-06: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the…
CVE-2026-75101 - CVSS 6.5 (medium), 2026-09-22: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or…
CVE-2026-77912 - CVSS 7.4 (high), 2026-09-22: A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML…
CVE-2026-77987 - CVSS 9.8 (critical), 2026-09-22: A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme…
CVE-2026-76851 - CVSS 8.8 (high), 2026-09-01: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient…
CVE-2026-19118 - CVSS 7.7 (high), 2026-09-01: A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required…
CVE-2026-18730 - CVSS 8.2 (high), 2026-09-01: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API…
CVE-2026-15996 - CVSS 7.5 (high), 2026-08-05: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and…
CVE-2026-17556 - CVSS 9.1 (critical), 2026-08-05: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories…
CVE-2026-15783 - CVSS 5.3 (medium), 2026-07-17: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to…
CVE-2026-15343 - CVSS 8.6 (high), 2026-07-17: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater…
CVE-2026-15007 - CVSS 5.7 (medium), 2026-07-17: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a…
CVE-2026-14340 - CVSS 5.3 (medium), 2026-07-01: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to…
CVE-2026-10585 - CVSS 6.3 (medium), 2026-06-30: A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript…
CVE-2026-9132 - CVSS 6.5 (medium), 2026-06-30: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private…
CVE-2026-9106 - CVSS 5.5 (medium), 2026-06-30: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an…
CVE-2026-9312 - CVSS 9.2 (critical), 2026-05-27: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted…
CVE-2026-8606 - CVSS 7 (high), 2026-05-27: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP…
CVE-2026-8106 - CVSS 6.1 (medium), 2026-05-07: A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The…
CVE-2026-8034 - CVSS 9.8 (critical), 2026-05-07: A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal…
CVE-2026-7541 - CVSS 7.5 (high), 2026-05-07: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending…
CVE-2026-6736 - CVSS 6.5 (medium), 2026-05-07: An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account,…
CVE-2026-5921 - CVSS 8.9 (high), 2026-04-21: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment…
CVE-2026-5845 - CVSS 9.6 (critical), 2026-04-21: An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to…
CVE-2026-5512 - CVSS 5.3 (medium), 2026-04-21: An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private…
CVE-2026-4296 - CVSS 8.8 (high), 2026-04-21: An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An…
CVE-2026-3307 - CVSS 5.3 (medium), 2026-04-21: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the…
CVE-2026-3582 - CVSS 5.3 (medium), 2026-03-10: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token…
CVE-2026-2266 - CVSS 7.4 (high), 2026-03-10: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed DOM-based cross-site scripting via task list…
CVE-2026-3854 - CVSS 8.8 (high), 2026-03-10: An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a…
CVE-2026-3306 - CVSS 5.3 (medium), 2026-03-10: An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a…
CVE-2026-1999 - CVSS 7.1 (high), 2026-02-18: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository…
CVE-2026-1355 - CVSS 6.5 (medium), 2026-02-18: A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to upload unauthorized content to another user’s…
CVE-2026-0573 - CVSS 9 (critical), 2026-02-18: An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens.…
CVE-2025-13744 - CVSS 8.4 (high), 2026-01-06: An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML…
CVE-2025-14046 - CVSS 8.6 (high), 2025-12-11: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs…
CVE-2025-11892 - CVSS 9.6 (critical), 2025-11-10: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search…
CVE-2025-11578 - CVSS 7.5 (high), 2025-11-10: A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the…
CVE-2025-8447 - CVSS 7 (high), 2025-08-26: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code…
CVE-2025-6981 - CVSS 5.3 (medium), 2025-07-15: An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the…
CVE-2025-6600 - CVSS 6.3 (medium), 2025-07-01: An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private…
CVE-2025-3246 - CVSS 8.6 (high), 2025-04-17: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used…
CVE-2025-3509 - CVSS 7.2 (high), 2025-04-17: A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the…
CVE-2025-3124 - CVSS 5.3 (medium), 2025-04-17: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they…
CVE-2024-10001 - CVSS 7.1 (high), 2025-01-29: A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the…
CVE-2025-23369 - CVSS 8.8 (high), 2025-01-21: An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized…
CVE-2024-8810 - CVSS 8.7 (high), 2024-11-07: A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An…
CVE-2024-10824 - CVSS 6.5 (medium), 2024-11-07: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning…
CVE-2024-10007 - CVSS 9.1 (critical), 2024-11-07: A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via…
CVE-2024-9539 - CVSS 5.7 (medium), 2024-10-11: An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata…
CVE-2024-9487 - CVSS 9.5 (critical), 2024-10-10: An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be…
CVE-2024-8770 - CVSS 6.1 (medium), 2024-09-23: A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal…
CVE-2024-8263 - CVSS 6.2 (medium), 2024-09-23: An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This…
CVE-2024-7711 - CVSS 5.3 (medium), 2024-08-20: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any…
CVE-2024-6337 - CVSS 6.5 (medium), 2024-08-20: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write:…
CVE-2024-6800 - CVSS 9.8 (critical), 2024-08-20: An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers…
CVE-2024-6395 - CVSS 6.3 (medium), 2024-07-16: An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that…
CVE-2024-5817 - CVSS 6.5 (medium), 2024-07-16: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was…
CVE-2024-5816 - CVSS 6.9 (medium), 2024-07-16: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via…
CVE-2024-5815 - CVSS 6.8 (medium), 2024-07-16: A Cross-Site Request Forgery vulnerability in GitHub Enterprise Server allowed write operations on a victim-owned repository by exploiting incorrect request…
CVE-2024-6336 - CVSS 6.9 (medium), 2024-07-16: A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitHub Enterprise…
CVE-2024-5795 - CVSS 7.7 (high), 2024-07-16: A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a…
CVE-2024-5566 - CVSS 6.5 (medium), 2024-07-16: An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal…
CVE-2024-5746 - CVSS 7.6 (high), 2024-06-20: A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain…
CVE-2024-4985 - CVSS 10 (critical), 2024-05-20: An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional…
CVE-2024-2440 - CVSS 5.9 (medium), 2024-04-19: A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter…
CVE-2024-3684 - CVSS 8 (high), 2024-04-19: A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console…
CVE-2024-3646 - CVSS 8 (high), 2024-04-19: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-3470 - CVSS 7.2 (high), 2024-04-19: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an…
CVE-2024-1908 - CVSS 6.5 (medium), 2024-03-21: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub…
CVE-2024-2748 - CVSS 4.3 (medium), 2024-03-21: A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an…
CVE-2024-2469 - CVSS 8 (high), 2024-03-20: An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub…
CVE-2024-2443 - CVSS 9.1 (critical), 2024-03-20: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1482 - CVSS 7.1 (high), 2024-02-14: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and…
CVE-2024-1369 - CVSS 9.1 (critical), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1378 - CVSS 9.1 (critical), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1374 - CVSS 9.1 (critical), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1372 - CVSS 9.1 (critical), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1354 - CVSS 8 (high), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1084 - CVSS 6.5 (medium), 2024-02-13: Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user…
CVE-2024-1359 - CVSS 9.1 (critical), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1355 - CVSS 9.1 (critical), 2024-02-13: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
CVE-2024-1082 - CVSS 6.5 (medium), 2024-02-13: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying…
CVE-2024-0507 - CVSS 8.8 (high), 2024-01-16: An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the…
CVE-2024-0200 - CVSS 9.8 (critical), 2024-01-16: An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the…
CVE-2023-6847 - CVSS 7.5 (high), 2023-12-21: An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API…
CVE-2023-6804 - CVSS 6.5 (medium), 2023-12-21: Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have…
CVE-2023-6690 - CVSS 3.9 (low), 2023-12-21: A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to…
CVE-2023-6803 - CVSS 5.8 (medium), 2023-12-21: A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected…
CVE-2023-6802 - CVSS 7.2 (high), 2023-12-21: An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain…
CVE-2023-6746 - CVSS 8.1 (high), 2023-12-21: An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could…
CVE-2023-51380 - CVSS 4.3 (medium), 2023-12-21: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped…
CVE-2023-51379 - CVSS 4.9 (medium), 2023-12-21: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token.…
CVE-2023-46649 - CVSS 7 (high), 2023-12-21: A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be…
CVE-2023-46648 - CVSS 8.3 (high), 2023-12-21: An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES…
CVE-2023-46646 - CVSS 5.3 (medium), 2023-12-21: Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get a check run" API…
CVE-2023-46645 - CVSS 6.8 (medium), 2023-12-21: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit…
CVE-2023-46647 - CVSS 8.8 (high), 2023-12-21: Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to…
CVE-2023-23766 - CVSS 6.5 (medium), 2023-09-22: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened…