# cve.now: Github

The newest entries naming Github as an affected vendor (up to 200), of 165 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118237](https://cve.now/CVE-2026-118237.md): Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service (CVSS 5.3)
- [CVE-2026-110288](https://cve.now/CVE-2026-110288.md): Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the… (CVSS 5.3)
- [CVE-2026-104608](https://cve.now/CVE-2026-104608.md): Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service (CVSS 7.7)
- [CVE-2026-96890](https://cve.now/CVE-2026-96890.md): Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts (CVSS 8.7)
- [CVE-2026-103620](https://cve.now/CVE-2026-103620.md): Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL (CVSS 6.0)
- [CVE-2026-75101](https://cve.now/CVE-2026-75101.md): Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision (CVSS 6.0)
- [CVE-2026-77912](https://cve.now/CVE-2026-77912.md): Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline (CVSS 7.4)
- [CVE-2026-77987](https://cve.now/CVE-2026-77987.md): GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery (CVSS 9.3)
- [CVE-2026-76851](https://cve.now/CVE-2026-76851.md): Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services (CVSS 7.7)
- [CVE-2026-19118](https://cve.now/CVE-2026-19118.md): Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution (CVSS 7.7)
- [CVE-2026-18730](https://cve.now/CVE-2026-18730.md): Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token (CVSS 8.2)
- [CVE-2026-18428](https://cve.now/CVE-2026-18428.md): SQL Query Validation Bypass in OpenSearch Direct Query (CVSS 8.7)
- [CVE-2026-18952](https://cve.now/CVE-2026-18952.md): Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin (CVSS 8.6)
- [CVE-2026-19311](https://cve.now/CVE-2026-19311.md): Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin (CVSS 8.6)
- [CVE-2026-15996](https://cve.now/CVE-2026-15996.md): Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters (CVSS 6.6)
- [CVE-2026-17556](https://cve.now/CVE-2026-17556.md): Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header (CVSS 8.8)
- [CVE-2026-47427](https://cve.now/CVE-2026-47427.md): GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler (CVSS 7.5)
- [CVE-2026-54163](https://cve.now/CVE-2026-54163.md): secure\_headers: CSP directive injection via sandbox, plugin\_types, and report\_to when given untrusted input (CVSS 4.7)
- [CVE-2026-15783](https://cve.now/CVE-2026-15783.md): Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites (CVSS 5.3)
- [CVE-2026-15343](https://cve.now/CVE-2026-15343.md): Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions… (CVSS 8.6)
- [CVE-2026-15007](https://cve.now/CVE-2026-15007.md): Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration (CVSS 5.7)
- [CVE-2026-14340](https://cve.now/CVE-2026-14340.md): An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories (CVSS 5.3)
- [CVE-2026-10585](https://cve.now/CVE-2026-10585.md): Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category (CVSS 6.3)
- [CVE-2026-9132](https://cve.now/CVE-2026-9132.md): Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint (CVSS 6.0)
- [CVE-2026-9106](https://cve.now/CVE-2026-9106.md): UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen (CVSS 4.8)
- [CVE-2026-48529](https://cve.now/CVE-2026-48529.md): GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion (CVSS 6.0)
- [CVE-2026-9312](https://cve.now/CVE-2026-9312.md): Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint (CVSS 9.2)
- [CVE-2026-8606](https://cve.now/CVE-2026-8606.md): Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint (CVSS 7.0)
- [CVE-2026-45033](https://cve.now/CVE-2026-45033.md): GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor (CVSS 8.5)
- [CVE-2026-8106](https://cve.now/CVE-2026-8106.md): Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft (CVSS 5.9)
- [CVE-2026-8034](https://cve.now/CVE-2026-8034.md): Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion (CVSS 7.9)
- [CVE-2026-7541](https://cve.now/CVE-2026-7541.md): Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint (CVSS 6.3)
- [CVE-2026-6736](https://cve.now/CVE-2026-6736.md): Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider (CVSS 6.3)
- [CVE-2026-5845](https://cve.now/CVE-2026-5845.md): Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server (CVSS 7.2)
- [CVE-2026-3307](https://cve.now/CVE-2026-3307.md): Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers (CVSS 5.3)
- [CVE-2026-5512](https://cve.now/CVE-2026-5512.md): Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API (CVSS 5.3)
- [CVE-2026-4296](https://cve.now/CVE-2026-4296.md): Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass (CVSS 7.5)
- [CVE-2026-5921](https://cve.now/CVE-2026-5921.md): Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack (CVSS 8.9)
- [CVE-2026-3582](https://cve.now/CVE-2026-3582.md): Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope (CVSS 5.3)
- [CVE-2026-2266](https://cve.now/CVE-2026-2266.md): Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection (CVSS 7.4)
- [CVE-2026-3306](https://cve.now/CVE-2026-3306.md): Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access (CVSS 5.3)
- [CVE-2026-3854](https://cve.now/CVE-2026-3854.md): Remote code execution via git push option injection in GitHub Enterprise Server (CVSS 8.7)
- [CVE-2026-29783](https://cve.now/CVE-2026-29783.md): GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution (CVSS 7.5)
- [CVE-2018-25188](https://cve.now/CVE-2018-25188.md): Webiness Inventory 2.3 SQL Injection via WsModelGrid.php (CVSS 8.8)
- [CVE-2026-1999](https://cve.now/CVE-2026-1999.md): Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests (CVSS 7.1)
- [CVE-2026-1355](https://cve.now/CVE-2026-1355.md): Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports (CVSS 6.0)
- [CVE-2026-0573](https://cve.now/CVE-2026-0573.md): Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution (CVSS 7.6)
- [CVE-2025-13744](https://cve.now/CVE-2025-13744.md): Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML (CVSS 8.4)
- [CVE-2025-14046](https://cve.now/CVE-2025-14046.md): Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests (CVSS 8.6)
- [CVE-2025-11578](https://cve.now/CVE-2025-11578.md): Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation (CVSS 7.5)
- [CVE-2025-11892](https://cve.now/CVE-2025-11892.md): DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers (CVSS 8.6)
- [CVE-2025-8447](https://cve.now/CVE-2025-8447.md): Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access (CVSS 7.0)
- [CVE-2025-6981](https://cve.now/CVE-2025-6981.md): Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access (CVSS 5.3)
- [CVE-2025-6600](https://cve.now/CVE-2025-6600.md): GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API (CVSS 6.3)
- [CVE-2025-3246](https://cve.now/CVE-2025-3246.md): Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers (CVSS 8.6)
- [CVE-2025-3509](https://cve.now/CVE-2025-3509.md): Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation (CVSS 7.1)
- [CVE-2025-3124](https://cve.now/CVE-2025-3124.md): Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names (CVSS 5.3)
- [CVE-2024-10001](https://cve.now/CVE-2024-10001.md): Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling (CVSS 7.1)
- [CVE-2025-24362](https://cve.now/CVE-2025-24362.md): CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts (CVSS 7.1)
- [CVE-2025-23369](https://cve.now/CVE-2025-23369.md): Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation (CVSS 7.6)
- [CVE-2024-8810](https://cve.now/CVE-2024-8810.md): Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access (CVSS 8.7)
- [CVE-2024-10824](https://cve.now/CVE-2024-10824.md): Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data (CVSS 6.0)
- [CVE-2024-10007](https://cve.now/CVE-2024-10007.md): Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation (CVSS 8.7)
- [CVE-2024-9539](https://cve.now/CVE-2024-9539.md): An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to (CVSS 5.7)
- [CVE-2024-9487](https://cve.now/CVE-2024-9487.md): An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled (CVSS 9.5)
- [CVE-2024-8263](https://cve.now/CVE-2024-8263.md): An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of (CVSS 6.2)
- [CVE-2024-8770](https://cve.now/CVE-2024-8770.md): A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attac (CVSS 5.8)
- [CVE-2024-6800](https://cve.now/CVE-2024-6800.md): An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific… (CVSS 9.5)
- [CVE-2024-6337](https://cve.now/CVE-2024-6337.md): Incorrect Authorization allows read access to issues in GitHub Enterprise Server (CVSS 5.9)
- [CVE-2024-7711](https://cve.now/CVE-2024-7711.md): An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, an (CVSS 5.3)
- [CVE-2024-6395](https://cve.now/CVE-2024-6395.md): GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys (CVSS 6.3)
- [CVE-2024-6336](https://cve.now/CVE-2024-6336.md): Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure (CVSS 6.9)
- [CVE-2024-5817](https://cve.now/CVE-2024-5817.md): Improper authorization allows read access to issue content in GitHub Enterprise Server (CVSS 5.9)
- [CVE-2024-5816](https://cve.now/CVE-2024-5816.md): Improper authorization allows persistent access in GitHub Enterprise Server (CVSS 6.9)
- [CVE-2024-5815](https://cve.now/CVE-2024-5815.md): Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository (CVSS 6.8)
- [CVE-2024-5795](https://cve.now/CVE-2024-5795.md): Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion (CVSS 7.7)
- [CVE-2024-5566](https://cve.now/CVE-2024-5566.md): Improper Privilege Management allows for access to unauthorized repository content during migration (CVSS 5.8)
- [CVE-2024-5746](https://cve.now/CVE-2024-5746.md): A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator (CVSS 7.6)
- [CVE-2024-4985](https://cve.now/CVE-2024-4985.md): An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication (CVSS 10.0)
- [CVE-2024-2440](https://cve.now/CVE-2024-2440.md): Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions (CVSS 5.5)
- [CVE-2024-3684](https://cve.now/CVE-2024-3684.md): Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console (CVSS 8.0)
- [CVE-2024-3646](https://cve.now/CVE-2024-3646.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console (CVSS 8.0)
- [CVE-2024-3470](https://cve.now/CVE-2024-3470.md): Repository administrator can bypass organization's ruleset using deploy keys (CVSS 5.9)
- [CVE-2024-2748](https://cve.now/CVE-2024-2748.md): CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user (CVSS 4.3)
- [CVE-2024-2443](https://cve.now/CVE-2024-2443.md): Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console (CVSS 9.1)
- [CVE-2024-2469](https://cve.now/CVE-2024-2469.md): Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance (CVSS 8.0)
- [CVE-2024-1908](https://cve.now/CVE-2024-1908.md): Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation (CVSS 6.3)
- [CVE-2024-25129](https://cve.now/CVE-2024-25129.md): Limited data exfiltration in CodeQL CLI (CVSS 2.7)
- [CVE-2024-1482](https://cve.now/CVE-2024-1482.md): Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution (CVSS 7.1)
- [CVE-2024-1378](https://cve.now/CVE-2024-1378.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1)
- [CVE-2024-1374](https://cve.now/CVE-2024-1374.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1)
- [CVE-2024-1372](https://cve.now/CVE-2024-1372.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1)
- [CVE-2024-1369](https://cve.now/CVE-2024-1369.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1)
- [CVE-2024-1359](https://cve.now/CVE-2024-1359.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1)
- [CVE-2024-1355](https://cve.now/CVE-2024-1355.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1)
- [CVE-2024-1354](https://cve.now/CVE-2024-1354.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 8.0)
- [CVE-2024-1082](https://cve.now/CVE-2024-1082.md): Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload (CVSS 6.3)
- [CVE-2024-1084](https://cve.now/CVE-2024-1084.md): Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that req (CVSS 6.5)
- [CVE-2024-0507](https://cve.now/CVE-2024-0507.md): Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server (CVSS 6.5)
- [CVE-2024-0200](https://cve.now/CVE-2024-0200.md): Unsafe Reflection in Github Enterprise Server leading to Command Injection (CVSS 7.2)
- [CVE-2023-6847](https://cve.now/CVE-2023-6847.md): Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data (CVSS 7.5)
- [CVE-2023-51380](https://cve.now/CVE-2023-51380.md): Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server (CVSS 2.7)
- [CVE-2023-51379](https://cve.now/CVE-2023-51379.md): Incorrect Authorization for Issue Comments in GitHub Enterprise Server (CVSS 4.9)
- [CVE-2023-46648](https://cve.now/CVE-2023-46648.md): Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token (CVSS 8.3)
- [CVE-2023-46649](https://cve.now/CVE-2023-46649.md): Race Condition allows Administrative Access on Organization Repositories (CVSS 6.3)
- [CVE-2023-6804](https://cve.now/CVE-2023-6804.md): Improper Privilege Management allows for arbitrary workflows to be run (CVSS 6.5)
- [CVE-2023-6803](https://cve.now/CVE-2023-6803.md): Race Condition allows Unauthorized Outside Collaborator (CVSS 5.8)
- [CVE-2023-6802](https://cve.now/CVE-2023-6802.md): Sensitive Information in Log File in GitHub Enterprise Server (CVSS 7.2)
- [CVE-2023-6746](https://cve.now/CVE-2023-6746.md): Sensitive Information in Log File in GitHub Enterprise Server (CVSS 8.1)
- [CVE-2023-46645](https://cve.now/CVE-2023-46645.md): Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site (CVSS 6.8)
- [CVE-2023-6690](https://cve.now/CVE-2023-6690.md): A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a Graph (CVSS 3.9)
- [CVE-2023-46647](https://cve.now/CVE-2023-46647.md): Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation (CVSS 8.0)
- [CVE-2023-46646](https://cve.now/CVE-2023-46646.md): Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the "Get (CVSS 5.3)
- [CVE-2023-23766](https://cve.now/CVE-2023-23766.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 4.5)
- [CVE-2023-23763](https://cve.now/CVE-2023-23763.md): Information disclosure in GitHub Enterprise Server leading to private repository leakage (CVSS 5.3)
- [CVE-2023-23765](https://cve.now/CVE-2023-23765.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 4.8)
- [CVE-2023-23764](https://cve.now/CVE-2023-23764.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 4.8)
- [CVE-2023-37463](https://cve.now/CVE-2023-37463.md): Quadratic complexity bugs may lead to a denial of service (CVSS 6.4)
- [CVE-2023-23762](https://cve.now/CVE-2023-23762.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 6.5)
- [CVE-2023-23761](https://cve.now/CVE-2023-23761.md): Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists (CVSS 7.7)
- [CVE-2023-24824](https://cve.now/CVE-2023-24824.md): Quadratic complexity may lead to a denial of service in cmark-gfm (CVSS 5.3)
- [CVE-2023-26485](https://cve.now/CVE-2023-26485.md): Quadratic complexity may lead to a denial of service in cmark-gfm (CVSS 5.3)
- [CVE-2023-23760](https://cve.now/CVE-2023-23760.md): Path traversal in GitHub Enterprise Server leading to remote code execution (CVSS 4.9)
- [CVE-2022-46257](https://cve.now/CVE-2022-46257.md): Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names (no CVSS)
- [CVE-2023-22381](https://cve.now/CVE-2023-22381.md): Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions (CVSS 4.1)
- [CVE-2023-22380](https://cve.now/CVE-2023-22380.md): Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site (CVSS 6.5)
- [CVE-2023-22486](https://cve.now/CVE-2023-22486.md): cmark-gfm Quadratic complexity bug in handle\_close\_bracket may lead to a denial of service (CVSS 3.5)
- [CVE-2023-22485](https://cve.now/CVE-2023-22485.md): cmark-gfm out-of-bounds read in validate\_protocol (CVSS 5.3)
- [CVE-2023-22484](https://cve.now/CVE-2023-22484.md): Inefficient Quadratic complexity bug in handle\_pointy\_brace may lead to a denial of service (CVSS 3.5)
- [CVE-2023-22483](https://cve.now/CVE-2023-22483.md): cmark-gfm Quadratic complexity bugs may lead to a denial of service (CVSS 3.5)
- [CVE-2022-23739](https://cve.now/CVE-2022-23739.md): Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens (CVSS 9.8)
- [CVE-2022-46258](https://cve.now/CVE-2022-46258.md): Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope (CVSS 6.5)
- [CVE-2022-46256](https://cve.now/CVE-2022-46256.md): Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages (CVSS 8.8)
- [CVE-2022-46255](https://cve.now/CVE-2022-46255.md): Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE (CVSS 9.8)
- [CVE-2022-23741](https://cve.now/CVE-2022-23741.md): Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access (CVSS 7.2)
- [CVE-2022-23737](https://cve.now/CVE-2022-23737.md): Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion (CVSS 6.5)
- [CVE-2022-23740](https://cve.now/CVE-2022-23740.md): Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution (CVSS 8.8)
- [CVE-2022-23738](https://cve.now/CVE-2022-23738.md): Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files (CVSS 5.7)
- [CVE-2022-23734](https://cve.now/CVE-2022-23734.md): Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution (CVSS 8.8)
- [CVE-2022-39209](https://cve.now/CVE-2022-39209.md): Uncontrolled Resource Consumption in cmark-gfm (CVSS 7.5)
- [CVE-2022-23733](https://cve.now/CVE-2022-23733.md): Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes (no CVSS)
- [CVE-2022-31026](https://cve.now/CVE-2022-31026.md): Use of Uninitialized Variable in trilogy (CVSS 5.9)
- [CVE-2022-23732](https://cve.now/CVE-2022-23732.md): Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections (no CVSS)
- [CVE-2022-24724](https://cve.now/CVE-2022-24724.md): Integer overflow in table parsing extension leads to heap memory corruption (CVSS 8.8)
- [CVE-2022-24722](https://cve.now/CVE-2022-24722.md): Cross-site Scripting in view\_component (CVSS 8.1)
- [CVE-2021-41599](https://cve.now/CVE-2021-41599.md): Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution (no CVSS)
- [CVE-2021-41598](https://cve.now/CVE-2021-41598.md): UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user (no CVSS)
- [CVE-2021-22870](https://cve.now/CVE-2021-22870.md): Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access (no CVSS)
- [CVE-2021-22868](https://cve.now/CVE-2021-22868.md): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (no CVSS)
- [CVE-2021-22869](https://cve.now/CVE-2021-22869.md): Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group (no CVSS)
- [CVE-2021-37700](https://cve.now/CVE-2021-37700.md): Clipboard-based DOM-XSS (CVSS 6.5)
- [CVE-2021-22867](https://cve.now/CVE-2021-22867.md): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (no CVSS)
- [CVE-2021-32638](https://cve.now/CVE-2021-32638.md): CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated (CVSS 4.4)
- [CVE-2021-22866](https://cve.now/CVE-2021-22866.md): UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resources (no CVSS)
- [CVE-2021-22865](https://cve.now/CVE-2021-22865.md): Improper access control in GitHub Enterprise Server leading to unauthorized read access to private repository metadata (no CVSS)
- [CVE-2021-22864](https://cve.now/CVE-2021-22864.md): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (no CVSS)
- [CVE-2021-22863](https://cve.now/CVE-2021-22863.md): Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests (no CVSS)
- [CVE-2021-22862](https://cve.now/CVE-2021-22862.md): Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks (no CVSS)
- [CVE-2021-22861](https://cve.now/CVE-2021-22861.md): Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories (no CVSS)
- [CVE-2020-10519](https://cve.now/CVE-2020-10519.md): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (no CVSS)
- [CVE-2020-10517](https://cve.now/CVE-2020-10517.md): Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names (no CVSS)
- [CVE-2020-10518](https://cve.now/CVE-2020-10518.md): Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server (no CVSS)
- [CVE-2020-5238](https://cve.now/CVE-2020-5238.md): Denial of service in table parsing in cmark-gfm (CVSS 6.5)
- [CVE-2020-10516](https://cve.now/CVE-2020-10516.md): Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member (no CVSS)
- [CVE-2019-16765](https://cve.now/CVE-2019-16765.md): If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension act (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/github
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.