Github - vulnerabilities (CVEs)

177 CVEs in 34 products, 2 in the last 30 days, newest from 2026-10-06.

Products

Enterprise Server - 126 CVEs
Github Enterprise Server - 46 CVEs
Cmark-gfm - 10 CVEs
Github - 9 CVEs
Cli - 4 CVEs
Opensearch - 3 CVEs
Codeql-action - 2 CVEs
Copilot-cli - 2 CVEs
Github-mcp-server - 2 CVEs
491-project - 1 CVEs
Actions/artifact - 1 CVEs
Actions Toolkit - 1 CVEs
Codeql-cli-binaries - 1 CVEs
Codeql Action - 1 CVEs
Codeql Cli - 1 CVEs
Copilot Command Line Interface - 1 CVEs
Gaug.es - 1 CVEs
Gh-ost - 1 CVEs
Go-gh - 1 CVEs
Hub - 1 CVEs
Mcp Server - 1 CVEs
Paste-markdown - 1 CVEs
Pull Requests And Issues - 1 CVEs
Runner - 1 CVEs
Secure Headers - 1 CVEs
Toolkit - 1 CVEs
Trilogy - 1 CVEs
View Component - 1 CVEs
Viewcomponent - 1 CVEs
Vscode-codeql - 1 CVEs
Btcsuite Go-socks - 0 CVEs
Gh-aw-firewall - 0 CVEs
Github Agentic Workflows - 0 CVEs
Owslib - 0 CVEs

Newest CVEs of Github

CVE-2026-96890 - CVSS 8.8 (high), 2026-10-06: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to…
CVE-2026-103620 - CVSS 6.5 (medium), 2026-10-06: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the…
CVE-2026-75101 - CVSS 6.5 (medium), 2026-09-22: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or…
CVE-2026-77912 - CVSS 7.4 (high), 2026-09-22: A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML…
CVE-2026-77987 - CVSS 9.8 (critical), 2026-09-22: A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme…
CVE-2026-76851 - CVSS 8.8 (high), 2026-09-01: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient…
CVE-2026-19118 - CVSS 7.7 (high), 2026-09-01: A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required…
CVE-2026-18730 - CVSS 8.2 (high), 2026-09-01: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API…
CVE-2026-18428 - CVSS 8.8 (high), 2026-08-13: A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to…
CVE-2026-18952 - CVSS 8.6 (high), 2026-08-12: Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to…
CVE-2026-19311 - CVSS 8.6 (high), 2026-08-12: Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete…
CVE-2026-15996 - CVSS 7.5 (high), 2026-08-05: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and…
CVE-2026-17556 - CVSS 9.1 (critical), 2026-08-05: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories…
CVE-2026-47427 - CVSS 7.5 (high), 2026-07-28: GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first…
CVE-2026-54163 - CVSS 4.7 (medium), 2026-07-17: secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by…
CVE-2026-15783 - CVSS 5.3 (medium), 2026-07-17: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to…
CVE-2026-15343 - CVSS 8.6 (high), 2026-07-17: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater…
CVE-2026-15007 - CVSS 5.7 (medium), 2026-07-17: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a…
CVE-2026-14340 - CVSS 5.3 (medium), 2026-07-01: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to…
CVE-2026-10585 - CVSS 6.3 (medium), 2026-06-30: A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript…
CVE-2026-9132 - CVSS 6.5 (medium), 2026-06-30: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private…
CVE-2026-9106 - CVSS 5.5 (medium), 2026-06-30: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an…
CVE-2026-48529 - CVSS 6 (medium), 2026-06-26: GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is…
CVE-2026-48501 - CVSS 9.1 (critical), 2026-05-29: GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF…
CVE-2026-9312 - CVSS 9.2 (critical), 2026-05-27: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted…
CVE-2026-8606 - CVSS 7 (high), 2026-05-27: A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP…
CVE-2026-45803 - CVSS 3.5 (low), 2026-05-15: `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal…
CVE-2026-45033 - CVSS 8.5 (high), 2026-05-13: GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub…
CVE-2026-8106 - CVSS 6.1 (medium), 2026-05-07: A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The…
CVE-2026-8034 - CVSS 9.8 (critical), 2026-05-07: A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal…