Github vulnerabilities
165 CVEs and advisories name Github as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118237Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service
- CVE-2026-110288Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the…
- CVE-2026-104608Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
- CVE-2026-96890Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
- CVE-2026-103620Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
- CVE-2026-75101Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision
- CVE-2026-77912Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline
- CVE-2026-77987GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
- CVE-2026-76851Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services
- CVE-2026-19118Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
- CVE-2026-18730Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
- CVE-2026-18428SQL Query Validation Bypass in OpenSearch Direct Query
- CVE-2026-18952Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
- CVE-2026-19311Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
- CVE-2026-15996Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters
- CVE-2026-17556Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header
- CVE-2026-47427GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
- CVE-2026-54163secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
- CVE-2026-15783Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites
- CVE-2026-15343Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions…
- CVE-2026-15007Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration
- CVE-2026-14340An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories
- CVE-2026-10585Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category
- CVE-2026-9132Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint
- CVE-2026-9106UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen
- CVE-2026-48529GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
- CVE-2026-9312Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint
- CVE-2026-8606Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint
- CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
- CVE-2026-8106Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft