What’s Vulnerable › Products
GitHub Enterprise Server vulnerabilities
129 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 39 published in the last 12 months.
Check whether your GitHub Enterprise Server version is affected
Latest GitHub Enterprise Server vulnerabilities
- CVE-2026-96890 — Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts (CVSS 8.8)
- CVE-2026-103620 — Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL (CVSS 6.5)
- CVE-2026-77987 — GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery (CVSS 9.8)
- CVE-2026-77912 — Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline (CVSS 5.4)
- CVE-2026-75101 — Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision (CVSS 6.5)
- CVE-2026-76851 — Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services (CVSS 8.8)
- CVE-2026-19118 — Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution (CVSS 7.5)
- CVE-2026-18730 — Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token (CVSS 7.4)
- CVE-2026-15996 — Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters (CVSS 7.5)
- CVE-2026-17556 — Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header (CVSS 9.1)
- CVE-2026-15783 — Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites (CVSS 5.3)
- CVE-2026-15343 — Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths (CVSS 8.6)
- CVE-2026-15007 — Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration (CVSS 5.7)
- CVE-2026-14340 — An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories (CVSS 5.0)
- CVE-2026-10585 — Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category (CVSS 5.4)
- CVE-2026-9132 — Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint (CVSS 6.5)
- CVE-2026-9106 — UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen (CVSS 5.5)
- CVE-2026-9312 — Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint (CVSS 8.2)
- CVE-2026-8606 — Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint (CVSS 5.9)
- CVE-2026-8106 — Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft (CVSS 6.1)
- CVE-2026-8034 — Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion (CVSS 9.8)
- CVE-2026-7541 — Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint (CVSS 7.5)
- CVE-2026-6736 — Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider (CVSS 6.5)
- CVE-2026-5921 — Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack (CVSS 8.9)
- CVE-2026-5845 — Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server (CVSS 9.6)