# GitHub CVEs > GitHub: 65 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/github/cves Last updated: 2026-10-06T18:56:46Z 65 CVEs map to GitHub (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [GitHub](https://rewindex.com/company/github.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that GitHub’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-06 | [CVE-2026-96890](https://rewindex.com/cve/CVE-2026-96890.md) | Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts | 8.8 high | | | 2026-10-06 | [CVE-2026-103620](https://rewindex.com/cve/CVE-2026-103620.md) | Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL | 6.5 medium | | | 2026-09-22 | [CVE-2026-75101](https://rewindex.com/cve/CVE-2026-75101.md) | Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision | 6.5 medium | | | 2026-09-22 | [CVE-2026-77912](https://rewindex.com/cve/CVE-2026-77912.md) | Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline | 5.4 medium | | | 2026-09-22 | [CVE-2026-77987](https://rewindex.com/cve/CVE-2026-77987.md) | GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery | 9.8 critical | | | 2026-09-01 | [CVE-2026-76851](https://rewindex.com/cve/CVE-2026-76851.md) | Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services | 8.8 high | | | 2026-09-01 | [CVE-2026-19118](https://rewindex.com/cve/CVE-2026-19118.md) | Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution | 7.5 high | | | 2026-09-01 | [CVE-2026-18730](https://rewindex.com/cve/CVE-2026-18730.md) | Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token | 7.4 high | | | 2026-08-13 | [CVE-2026-18428](https://rewindex.com/cve/CVE-2026-18428.md) | SQL Query Validation Bypass in OpenSearch Direct Query | 8.8 high | | | 2026-08-12 | [CVE-2026-18952](https://rewindex.com/cve/CVE-2026-18952.md) | Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin | 8.1 high | | | 2026-08-12 | [CVE-2026-19311](https://rewindex.com/cve/CVE-2026-19311.md) | Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin | 8.1 high | | | 2026-08-05 | [CVE-2026-15996](https://rewindex.com/cve/CVE-2026-15996.md) | Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters | 7.5 high | | | 2026-08-05 | [CVE-2026-17556](https://rewindex.com/cve/CVE-2026-17556.md) | Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header | 9.1 critical | | | 2026-07-28 | [CVE-2026-47427](https://rewindex.com/cve/CVE-2026-47427.md) | GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler | 7.5 high | | | 2026-07-17 | [CVE-2026-54163](https://rewindex.com/cve/CVE-2026-54163.md) | secure\_headers: CSP directive injection via sandbox, plugin\_types, and report\_to when given untrusted input | 4.7 medium | | | 2026-07-17 | [CVE-2026-15783](https://rewindex.com/cve/CVE-2026-15783.md) | Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites | 5.3 medium | | | 2026-07-17 | [CVE-2026-15343](https://rewindex.com/cve/CVE-2026-15343.md) | Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths | 8.6 high | | | 2026-07-17 | [CVE-2026-15007](https://rewindex.com/cve/CVE-2026-15007.md) | Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration | 5.7 medium | | | 2026-07-01 | [CVE-2026-14340](https://rewindex.com/cve/CVE-2026-14340.md) | An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories | 5.0 medium | | | 2026-06-30 | [CVE-2026-10585](https://rewindex.com/cve/CVE-2026-10585.md) | Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category | 5.4 medium | | | 2026-06-30 | [CVE-2026-9132](https://rewindex.com/cve/CVE-2026-9132.md) | Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint | 6.5 medium | | | 2026-06-30 | [CVE-2026-9106](https://rewindex.com/cve/CVE-2026-9106.md) | UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen | 5.5 medium | | | 2026-06-26 | [CVE-2026-48529](https://rewindex.com/cve/CVE-2026-48529.md) | GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion | 6.0 medium | | | 2026-05-29 | [CVE-2026-48501](https://rewindex.com/cve/CVE-2026-48501.md) | GitHub CLI tokens leak via \`gh attestation\` commands | 7.4 high | | | 2026-05-27 | [CVE-2026-9312](https://rewindex.com/cve/CVE-2026-9312.md) | Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint | 8.2 high | | | 2026-05-26 | [CVE-2026-8606](https://rewindex.com/cve/CVE-2026-8606.md) | Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint | 5.9 medium | | | 2026-05-15 | [CVE-2026-45803](https://rewindex.com/cve/CVE-2026-45803.md) | gh: GitHub Actions log output in \`gh run view\` allows terminal escape sequence injection | 3.5 low | | | 2026-05-13 | [CVE-2026-45033](https://rewindex.com/cve/CVE-2026-45033.md) | GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor | 7.8 high | | | 2026-05-07 | [CVE-2026-8106](https://rewindex.com/cve/CVE-2026-8106.md) | Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft | 6.1 medium | | | 2026-05-07 | [CVE-2026-8034](https://rewindex.com/cve/CVE-2026-8034.md) | Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion | 9.8 critical | | | 2026-05-07 | [CVE-2026-7541](https://rewindex.com/cve/CVE-2026-7541.md) | Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint | 7.5 high | | | 2026-05-07 | [CVE-2026-6736](https://rewindex.com/cve/CVE-2026-6736.md) | Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider | 6.5 medium | | | 2026-04-21 | [CVE-2026-5845](https://rewindex.com/cve/CVE-2026-5845.md) | Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server | 9.6 critical | | | 2026-04-21 | [CVE-2026-3307](https://rewindex.com/cve/CVE-2026-3307.md) | Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers | 2.7 low | | | 2026-04-21 | [CVE-2026-5512](https://rewindex.com/cve/CVE-2026-5512.md) | Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API | 4.3 medium | | | 2026-04-21 | [CVE-2026-4296](https://rewindex.com/cve/CVE-2026-4296.md) | Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass | 8.8 high | | | 2026-04-21 | [CVE-2026-5921](https://rewindex.com/cve/CVE-2026-5921.md) | Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack | 8.9 high | | | 2026-03-10 | [CVE-2026-3582](https://rewindex.com/cve/CVE-2026-3582.md) | Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope | 4.3 medium | | | 2026-03-10 | [CVE-2026-2266](https://rewindex.com/cve/CVE-2026-2266.md) | Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection | 5.4 medium | | | 2026-03-10 | [CVE-2026-3306](https://rewindex.com/cve/CVE-2026-3306.md) | Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access | 4.3 medium | | | 2026-03-10 | [CVE-2026-3854](https://rewindex.com/cve/CVE-2026-3854.md) | Remote code execution via git push option injection in GitHub Enterprise Server | 8.8 high | | | 2026-03-06 | [CVE-2026-29783](https://rewindex.com/cve/CVE-2026-29783.md) | GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution | 7.8 high | | | 2026-03-06 | [CVE-2018-25188](https://rewindex.com/cve/CVE-2018-25188.md) | Webiness Inventory 2.3 SQL Injection via WsModelGrid.php | 8.2 high | | | 2026-02-18 | [CVE-2026-1999](https://rewindex.com/cve/CVE-2026-1999.md) | Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests | 6.5 medium | | | 2026-02-18 | [CVE-2026-1355](https://rewindex.com/cve/CVE-2026-1355.md) | Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports | 6.5 medium | | | 2026-02-18 | [CVE-2026-0573](https://rewindex.com/cve/CVE-2026-0573.md) | Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution | 9.0 critical | | | 2026-01-06 | [CVE-2025-13744](https://rewindex.com/cve/CVE-2025-13744.md) | Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML | 5.4 medium | | | 2025-12-11 | [CVE-2025-14046](https://rewindex.com/cve/CVE-2025-14046.md) | Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests | 6.1 medium | | | 2025-11-10 | [CVE-2025-11578](https://rewindex.com/cve/CVE-2025-11578.md) | Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation | 7.2 high | | | 2025-11-10 | [CVE-2025-11892](https://rewindex.com/cve/CVE-2025-11892.md) | DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers | 9.6 critical | | Next page: [page 2](https://rewindex.com/company/github/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (GitHub) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 1 | 1 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 1 | 0 | 2 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 1 | 3 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 1 | 2 | 1 | 1 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 1 | 1 | 2 | 0 | 0 | 0 | | 2026-05-11 | 0 | 1 | 0 | 1 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 2 | 1 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 4 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 1 | 3 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-08-03 | 1 | 1 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 3 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 1 | 0 | 2 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/github/cves · Markdown: https://rewindex.com/company/github/cves.md · JSON: https://rewindex.com/api/v1/companies/github/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:00:26.993Z