CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 4,063 CVEs published, 327 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
4,063
Show in the list
Critical, last 7 days
327
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,756
Show in the list

Showing CVEs that name the product github:enterprise_server. Show all products

39 CVEs, showing 1 to 39
CVESeverityTitlePublished
CVE-2026-96890High 8.7Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
Assigned by GitHub_P
Oct 6, 2026
CVE-2026-103620Medium 6.0Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
Assigned by GitHub_P
Oct 6, 2026
CVE-2026-75101Medium 6.0Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision
Assigned by GitHub_P
Sep 22, 2026
CVE-2026-77912High 7.4Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline
Assigned by GitHub_P
Sep 22, 2026
CVE-2026-77987Critical 9.3GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
Assigned by GitHub_P
Sep 22, 2026
CVE-2026-76851High 7.7Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services
Assigned by GitHub_P
Sep 1, 2026
CVE-2026-19118High 7.7Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
Assigned by GitHub_P
Sep 1, 2026
CVE-2026-18730High 8.2Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
Assigned by GitHub_P
Sep 1, 2026
CVE-2026-15996Medium 6.6Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters
Assigned by GitHub_P
Aug 5, 2026
CVE-2026-17556High 8.8Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header
Assigned by GitHub_P
Aug 5, 2026
CVE-2026-15783Medium 5.3Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites
Assigned by GitHub_P
Jul 17, 2026
CVE-2026-15343High 8.6Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths
Assigned by GitHub_P
Jul 17, 2026
CVE-2026-15007Medium 5.7Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration
Assigned by GitHub_P
Jul 17, 2026
CVE-2026-14340Medium 5.3An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories
Assigned by GitHub_P
Jul 1, 2026
CVE-2026-10585Medium 6.3Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category
Assigned by GitHub_P
Jun 30, 2026
CVE-2026-9132Medium 6.0Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint
Assigned by GitHub_P
Jun 30, 2026
CVE-2026-9106Medium 4.8UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen
Assigned by GitHub_P
Jun 30, 2026
CVE-2026-9312Critical 9.2Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint
Assigned by GitHub_P
May 26, 2026
CVE-2026-8606High 7.0Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint
Assigned by GitHub_P
May 26, 2026
CVE-2026-8106Medium 5.9Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft
Assigned by GitHub_P
May 7, 2026
CVE-2026-8034High 7.9Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion
Assigned by GitHub_P
May 7, 2026
CVE-2026-7541Medium 6.3Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint
Assigned by GitHub_P
May 7, 2026
CVE-2026-6736Medium 6.3Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider
Assigned by GitHub_P
May 7, 2026
CVE-2026-5845High 7.2Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server
Assigned by GitHub_P
Apr 21, 2026
CVE-2026-3307Medium 5.3Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers
Assigned by GitHub_P
Apr 21, 2026
CVE-2026-5512Medium 5.3Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API
Assigned by GitHub_P
Apr 21, 2026
CVE-2026-4296High 7.5Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass
Assigned by GitHub_P
Apr 21, 2026
CVE-2026-5921High 8.9Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack
Assigned by GitHub_P
Apr 21, 2026
CVE-2026-3582Medium 5.3Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope
Assigned by GitHub_P
Mar 10, 2026
CVE-2026-2266High 7.4Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection
Assigned by GitHub_P
Mar 10, 2026
CVE-2026-3306Medium 5.3Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access
Assigned by GitHub_P
Mar 10, 2026
CVE-2026-3854High 8.7Remote code execution via git push option injection in GitHub Enterprise Server
Assigned by GitHub_P
Mar 10, 2026
CVE-2026-1999High 7.1Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests
Assigned by GitHub_P
Feb 18, 2026
CVE-2026-1355Medium 6.0Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports
Assigned by GitHub_P
Feb 18, 2026
CVE-2026-0573High 7.6Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution
Assigned by GitHub_P
Feb 18, 2026
CVE-2025-13744High 8.4Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML
Assigned by GitHub_P
Jan 6, 2026
CVE-2025-14046High 8.6Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests
Assigned by GitHub_P
Dec 11, 2025
CVE-2025-11578High 7.5Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation
Assigned by GitHub_P
Nov 10, 2025
CVE-2025-11892High 8.6DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers
Assigned by GitHub_P
Nov 10, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.