ES
Product
Enterprise Server
129
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 20High 40Medium 65Low 4
Watch
Add Enterprise Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-77987 | 9.8 | Sep 22 | GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery Affected: 3.17.0 before 3.17.*; 3.18.0 before 3.18.*; 3.19.0 before 3.19.*; 3.20.0 before 3.20.*; 3.21.0 before 3.21.*; 3.22.0 before 3.22.* |
| CVE-2026-8034 | 9.8 | May 7 | Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion Affected: 3.16.0 through 3.16.17; 3.17.0 through 3.17.14; 3.18.0 through 3.18.8; 3.19.0 through 3.19.5; 3.20.0 through 3.20.1 |
| CVE-2024-6800 | 9.8 | Aug 20 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed… Affected: 3.10.0 before 3.10.16; 3.11.0 before 3.11.14; 3.12.0 before 3.12.8; 3.13.0 before 3.13.3 |
| CVE-2024-4985 | 9.8 | May 20 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions… Affected: before 3.9.15; 3.10.0 before 3.10.12; 3.11.0 before 3.11.10; 3.12.0 before 3.12.4 |
| CVE-2024-0200 | 9.8 | Jan 16 | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection Affected: 3.8.0 before 3.8.13; 3.9.0 before 3.9.8; 3.10.0 before 3.10.5; 3.11.0 before 3.11.3 |
| CVE-2022-23739 | 9.8 | Jan 17 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps Affected: before 3.3.16; 3.4.0 before 3.4.11; 3.5.0 before 3.5.8; 3.6.0 before 3.6.4; 3.7.0 |
| CVE-2022-46255 | 9.8 | Dec 14 | An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution Affected: 3.7.0 |
| CVE-2021-22869 | 9.8 | Sep 24 | An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to Affected: 3.0.0 before 3.0.16; 3.1.0 before 3.1.8 |
| CVE-2026-5845 | 9.6 | Apr 21 | Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server Affected: 3.20.0 before 3.20.1; 3.19.0 through 3.19.4; 3.18.0 through 3.18.7; 3.17.0 through 3.17.13; 3.16.0 through 3.16.16; 3.15.0 through 3.15.20; +1 more |
| CVE-2025-11892 | 9.6 | Nov 10 | DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers Affected: 3.18.0 before 3.18.1; 3.17.0 through 3.17.6; 3.16.0 through 3.16.9; 3.15.0 through 3.15.13; 3.14.0 through 3.14.18 |
| CVE-2026-17556 | 9.1 | Aug 5 | Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header Affected: 3.17.0 through 3.17.18; 3.18.0 through 3.18.12; 3.19.0 through 3.19.9; 3.20.0 through 3.20.5; 3.21.0 through 3.21.3 |
| CVE-2024-10007 | 9.1 | Nov 7 | Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation Affected: 3.11.0 through 3.11.16; 3.12.0 through 3.12.10; 3.13.0 through 3.13.5; 3.14.0 through 3.14.2 |
| CVE-2024-9487 | 9.1 | Oct 10 | An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled Affected: 3.11.0 through 3.11.15; 3.12.0 through 3.12.9; 3.13.0 through 3.13.4; 3.14.0 through 3.14.1 |
| CVE-2024-1378 | 9.1 | Feb 13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the… Affected: before 3.8.15; 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.5 |
| CVE-2024-1374 | 9.1 | Feb 13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the… Affected: before 3.8.15; 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.5 |
| CVE-2024-1372 | 9.1 | Feb 13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the… Affected: before 3.8.15; 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.5 |
| CVE-2024-1369 | 9.1 | Feb 13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the… Affected: before 3.8.15; 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.5 |
| CVE-2024-1359 | 9.1 | Feb 13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the… Affected: before 3.8.15; 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.5 |
| CVE-2024-1355 | 9.1 | Feb 13 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the… Affected: before 3.8.15; 3.9.0 before 3.9.10; 3.10.0 before 3.10.7; 3.11.0 before 3.11.5 |
| CVE-2026-0573 | 9.0 | Feb 18 | Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution Affected: 3.14 through 3.14.21; 3.15 through 3.15.16; 3.16 through 3.16.12; 3.17 through 3.17.9; 3.18 through 3.18.3; 3.19 through 3.19.1 |
Showing 20