Login Request a demo
GI
Vendor
GitHub
25 products with CVEs on record
195
CVEs
0
On KEV
2
New 30D
Products
ES
Enterprise Server
GitHub
9.8
129 CVEs0 on KEV2 new
GE
GitHub Enterprise Server
GitHub
9.8
18 CVEs0 on KEV0 new
CM
Cmark-gfm
Github
9.8
10 CVEs0 on KEV0 new
GI
Github
Github
9.8
9 CVEs0 on KEV0 new
CL
Cli
Github
9.6
4 CVEs0 on KEV0 new
OP
Opensearch
Github
8.8
3 CVEs0 on KEV0 new
CO
codeql-action
github
7.1
2 CVEs0 on KEV0 new
CO
copilot-cli
github
7.8
2 CVEs0 on KEV0 new
GI
github-mcp-server
github
7.5
2 CVEs0 on KEV0 new
49
491-project
Github
9.8
1 CVEs0 on KEV0 new
AC
Actions/artifact
Github
7.5
1 CVEs0 on KEV0 new
AT
Actions Toolkit
Github
7.5
1 CVEs0 on KEV0 new
CC
Codeql Cli
Github
5.5
1 CVEs0 on KEV0 new
CC
Copilot Command Line Interface
Github
7.8
1 CVEs0 on KEV0 new
GA
Gaug.es
Github
–
1 CVEs0 on KEV0 new
GH
Gh-ost
Github
6.5
1 CVEs0 on KEV0 new
GO
Go-gh
Github
7.5
1 CVEs0 on KEV0 new
HU
Hub
Github
–
1 CVEs0 on KEV0 new
MS
Mcp Server
Github
7.5
1 CVEs0 on KEV0 new
PR
Pull Requests And Issues
Github
7.8
1 CVEs0 on KEV0 new
RU
Runner
Github
9.9
1 CVEs0 on KEV0 new
SE
secure_headers
github
4.7
1 CVEs0 on KEV0 new
TO
Toolkit
Github
5.0
1 CVEs0 on KEV0 new
VI
Viewcomponent
Github
6.1
1 CVEs0 on KEV0 new
WI
Webiness Inventory
Github
8.2
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-96890
ES
Enterprise Server
GitHub
8.8
0%
Oct 6Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
CVE-2026-103620
ES
Enterprise Server
GitHub
6.5
0%
Oct 6Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
CVE-2026-75101
ES
Enterprise Server
GitHub
6.5
0%
Sep 22Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision
CVE-2026-77912
ES
Enterprise Server
GitHub
5.4
0%
Sep 22Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline
CVE-2026-77987
ES
Enterprise Server
GitHub
9.8
1%
Sep 22GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
CVE-2026-76851
ES
Enterprise Server
GitHub
8.8
1%
Sep 1Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services
CVE-2026-19118
ES
Enterprise Server
GitHub
7.5
1%
Sep 1Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
CVE-2026-18730
ES
Enterprise Server
GitHub
7.4
0%
Sep 1Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
CVE-2026-18428
OP
Opensearch
Github
8.8
1%
Aug 13SQL Query Validation Bypass in OpenSearch Direct Query
CVE-2026-18952
OP
Opensearch
Github
8.1
1%
Aug 12Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
CVE-2026-19311
OP
OpenSearch
Github
8.1
1%
Aug 12Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
CVE-2026-15996
ES
Enterprise Server
GitHub
7.5
1%
Aug 5Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters
CVE-2026-17556
ES
Enterprise Server
GitHub
9.1
1%
Aug 5Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header
CVE-2026-47427
GI
github-mcp-server
github
7.5
1%
Jul 28GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
CVE-2026-54163
SE
secure_headers
github
4.7
0%
Jul 17secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CVE-2026-15783
ES
Enterprise Server
GitHub
5.3
0%
Jul 17Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites
CVE-2026-15343
ES
Enterprise Server
GitHub
8.6
1%
Jul 17Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths
CVE-2026-15007
ES
Enterprise Server
GitHub
5.7
1%
Jul 17Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration
CVE-2026-14340
ES
Enterprise Server
GitHub
5.0
0%
Jul 1An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories
CVE-2026-10585
ES
Enterprise Server
GitHub
5.4
0%
Jun 30Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category
CVE-2026-9132
ES
Enterprise Server
GitHub
6.5
0%
Jun 30Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint
CVE-2026-9106
ES
Enterprise Server
GitHub
5.5
0%
Jun 30UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen
CVE-2026-48529
GI
github-mcp-server
github
6.0
0%
Jun 26GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
CVE-2026-48501
CL
Cli
Github
9.1
0%
May 29GitHub CLI tokens leak via `gh attestation` commands
CVE-2026-9312
ES
Enterprise Server
GitHub
8.2
9%
May 27Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint
CVE-2026-8606
ES
Enterprise Server
GitHub
5.9
0%
May 26Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint
CVE-2026-45803
CL
Cli
Github
3.5
0%
May 15gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
CVE-2026-45033
CO
copilot-cli
github
7.8
0%
May 13GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
CVE-2026-8106
ES
Enterprise Server
GitHub
6.1
0%
May 7Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft
CVE-2026-8034
ES
Enterprise Server
GitHub
9.8
1%
May 7Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion
CVE-2026-7541
ES
Enterprise Server
GitHub
7.5
0%
May 7Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint
CVE-2026-6736
ES
Enterprise Server
GitHub
6.5
0%
May 7Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider
CVE-2026-5845
ES
Enterprise Server
GitHub
9.6
0%
Apr 21Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server
CVE-2026-3307
ES
Enterprise Server
GitHub
2.7
0%
Apr 21Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers
CVE-2026-5512
ES
Enterprise Server
GitHub
4.3
0%
Apr 21Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API
CVE-2026-4296
ES
Enterprise Server
GitHub
8.8
0%
Apr 21Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass
CVE-2026-5921
ES
Enterprise Server
GitHub
8.9
0%
Apr 21Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack
CVE-2026-3582
ES
Enterprise Server
GitHub
4.3
0%
Mar 10Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope
CVE-2026-2266
ES
Enterprise Server
GitHub
5.4
0%
Mar 10Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection
CVE-2026-3306
ES
Enterprise Server
GitHub
4.3
0%
Mar 10Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access
CVE-2026-3854
ES
Enterprise Server
GitHub
8.8
40%
Mar 10Remote code execution via git push option injection in GitHub Enterprise Server
CVE-2026-29783
CO
copilot-cli
github
7.8
0%
Mar 6GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution
CVE-2018-25188
WI
Webiness Inventory
Github
8.2
0%
Mar 6Webiness Inventory 2.3 SQL Injection via WsModelGrid.php
CVE-2026-1999
ES
Enterprise Server
GitHub
6.5
0%
Feb 18Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests
CVE-2026-1355
ES
Enterprise Server
GitHub
6.5
0%
Feb 18Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports
CVE-2026-0573
ES
Enterprise Server
GitHub
9.0
1%
Feb 18Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution
CVE-2025-13744
ES
Enterprise Server
GitHub
5.4
0%
Jan 6Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML
CVE-2025-14046
ES
Enterprise Server
GitHub
6.1
0%
Dec 11Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests
CVE-2025-11578
ES
Enterprise Server
GitHub
7.2
1%
Nov 10Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation
CVE-2025-11892
ES
Enterprise Server
GitHub
9.6
1%
Nov 10DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers
CVE-2025-8447
ES
Enterprise Server
GitHub
3.1
0%
Aug 26Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access
CVE-2025-6981
ES
Enterprise Server
GitHub
4.3
0%
Jul 15Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access
CVE-2025-6600
GE
GitHub Enterprise Server
GitHub
4.3
0%
Jul 1GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API
CVE-2025-3246
GE
GitHub Enterprise Server
GitHub
7.6
0%
Apr 17Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers
CVE-2025-3509
ES
Enterprise Server
GitHub
7.2
1%
Apr 17Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
CVE-2025-3124
ES
Enterprise Server
GitHub
4.3
0%
Apr 17Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names
CVE-2024-10001
ES
Enterprise Server
GitHub
7.1
0%
Jan 29Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling
CVE-2025-24362
CO
codeql-action
github
7.1
1%
Jan 24CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts
CVE-2025-23369
ES
Enterprise Server
GitHub
8.8
2%
Jan 21Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation
CVE-2024-53858
CL
Cli
Github
6.5
0%
Nov 27Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli