GitHub · weakness class
Access Control
37 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 37 is a mark on the map. Named now: 1 to 26, most at risk first.
- If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's c…
- Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member
- Improper access control in GitHub Enterprise Server leading to unauthorized read access to private repository metadata
- Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens
- Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group
- Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access
- Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names
- Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests
- Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories
- Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks
- Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion
- Incorrect Authorization allows read access to issues in GitHub Enterprise Server
- Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation
- Incorrect Authorization for Issue Comments in GitHub Enterprise Server
- Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation
- Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope
- Repository administrator can bypass organization's ruleset using deploy keys
- Improper authorization allows read access to issue content in GitHub Enterprise Server
- Improper authorization allows persistent access in GitHub Enterprise Server
- Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
- An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public r…
- Improper Privilege Management allows for access to unauthorized repository content during migration
- Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server
- Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports
- Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites
- An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This vulnerability affect…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.