GitHub vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-96890 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to isHigh 8.7 · Oct 6, 2026
• CVE-2026-77987 A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server.Critical 9.3 · Sep 22, 2026
• CVE-2026-77912 A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attHigh 7.4 · Sep 22, 2026
• CVE-2026-76851 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance.High 7.7 · Sep 1, 2026
• CVE-2026-19118 A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution.High 7.7 · Sep 1, 2026
• CVE-2026-18730 A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API tHigh 8.2 · Sep 1, 2026
• CVE-2026-17556 A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on High 8.8 · Aug 5, 2026
• CVE-2026-47427 GitHub MCP Server is GitHub's official MCP Server.High 7.5 · Jul 28, 2026
• CVE-2026-15343 A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater containeHigh 8.6 · Jul 17, 2026
• CVE-2026-9312 A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests Critical 9.2 · May 26, 2026
• CVE-2026-8606 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requestHigh 7 · May 26, 2026
• CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line.High 8.5 · May 13, 2026
• CVE-2026-8034 A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal seHigh 7.9 · May 7, 2026
• CVE-2026-5921 A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variableHigh 8.9 · Apr 21, 2026
• CVE-2026-5845 An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to acceHigh 7.2 · Apr 21, 2026
• CVE-2026-4296 An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation.High 7.5 · Apr 21, 2026
• CVE-2026-2266 An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed DOM-based cross-site scripting via task list content.High 7.4 · Mar 10, 2026
• CVE-2026-3854 An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repositorHigh 8.7 · Mar 10, 2026
• CVE-2026-29783 The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patHigh 7.5 · Mar 6, 2026
• CVE-2018-25188 Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious codHigh 8.8 · Mar 6, 2026
• CVE-2026-1999 An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to merge their own pull request into a repository wHigh 7.1 · Feb 18, 2026
• CVE-2026-0573 An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens.High 7.6 · Feb 18, 2026
• CVE-2025-13744 An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML toHigh 8.4 · Jan 6, 2026
• CVE-2025-14046 An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs thaHigh 8.6 · Dec 11, 2025
• CVE-2025-11892 An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label High 8.6 · Nov 10, 2025