GitHub Enterprise Server vulnerabilities

CVEs per yearBy the year they were published

1. 202321
2. 202424
3. 20259
4. 202639

Newest CVEs

• CVE-2026-118237

  Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service

  GitHub · Enterprise Server

  Medium5.3
• CVE-2026-110288

  Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console

  GitHub · Enterprise Server

  Medium5.3
• CVE-2026-104608

  Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service

  GitHub · Enterprise Server

  High7.7
• CVE-2026-96890

  Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

  GitHub · Enterprise Server

  High8.7
• CVE-2026-103620

  Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL

  GitHub · Enterprise Server

  Medium6.0
• CVE-2026-75101

  Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

  GitHub · Enterprise Server

  Medium6.0
• CVE-2026-77912

  Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

  GitHub · Enterprise Server

  High7.4
• CVE-2026-77987

  GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

  GitHub · Enterprise Server

  Critical9.3
• CVE-2026-76851

  Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

  GitHub · Enterprise Server

  High7.7
• CVE-2026-19118

  Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

  GitHub · Enterprise Server

  High7.7