Cross-site Scripting

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. Clipboard-based DOM-XSSCVE-2021-37700github · CVSS 6.5 · 1.7% likely

   CWE-79

2. Cross-site Scripting in view_componentCVE-2022-24722github · CVSS 8.1 · 1.1% likely

   CWE-79

3. DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggersCVE-2025-11892GitHub · CVSS 8.6 · 0.7% likely

   CWE-79

4. Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributesCVE-2022-23733GitHub · 0.6% likely

   CWE-79

5. Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engin…CVE-2024-1084GitHub · CVSS 6.5 · 0.5% likely

   CWE-79

6. Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsCVE-2025-14046GitHub · CVSS 8.6 · 0.4% likely

   CWE-79

7. A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user informatio…CVE-2024-8770GitHub · CVSS 5.8 · 0.4% likely

   CWE-79

8. Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A categoryCVE-2026-10585GitHub · CVSS 6.3 · 0.3% likely

   CWE-79

9. Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggersCVE-2025-3246GitHub · CVSS 8.6 · 0.3% likely

   CWE-79

10. Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLCVE-2025-13744GitHub · CVSS 8.4 · 0.2% likely

    CWE-79

11. secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputCVE-2026-54163github · CVSS 4.7 · 0.2% likely

    CWE-79

12. Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML inject…CVE-2026-2266GitHub · CVSS 7.4 · 0.2% likely

    CWE-79

13. Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineCVE-2026-77912GitHub · CVSS 7.4 · 0.2% likelycovered by CyberSIXT

    CWE-791 article

14. Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theftCVE-2026-8106GitHub · CVSS 5.9 · 0.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.