GitHub · weakness class
Command and Code Injection
14 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 1
- likely to be exploited
- 1
Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.
- Github Enterprise - Remote Code Execution
- Remote code execution via git push option injection in GitHub Enterprise Server
- Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server
- Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server
- Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server
- Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution
- Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
- Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution
- Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server
- Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console
- Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server
- Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions
- GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution
- Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.