Vendor
GitHub
- CVEs tracked · all time
- 7
- in CISA KEV · all time
- 0
- article · since 11 Sep
- 1
- articles · all time
- 8
One article in the last 45 daysThe latest: SecurityOnline, Thu 24 Sep, 02:30 UTC.See the full timeline
Products: Enterprise Server
CVEs
7 CVEsCVE-2026-77987GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgeryCVSS9.3Critical–Not in KEV0.9%EPSS1article
CVE-2026-18730Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer tokenCVSS8.2High–Not in KEV0.3%EPSS1article
CVE-2026-77912Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineCVSS7.4High–Not in KEV0.2%EPSS1article
CVE-2026-75101Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collisionCVSS6.0Medium–Not in KEV0.3%EPSS1article
CVE-2026-8606Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL EndpointCVSS7.0High–Not in KEV0.7%EPSS1article
CVE-2026-3854Remote code execution via git push option injection in GitHub Enterprise ServerCVSS8.7High–Not in KEV39%EPSS6articles
- GitHub Enterprise Server Flaw Could Expose Secrets and Enable RCESecurityOnline
- GitHub fixes SSRF bug CVE-2026-9312 and kernel flawsSecurityOnline
- Hacker News Weekly: Exploits Outpace Patches, Systems at Risk.The Hacker News
- AI Tools Uncover Critical GitHub RCE Bug CVE-2026-3854Dark Reading
- CVE-2026-3854: GitHub patches critical RCE bug in push pipelineSOCRadar
- Critical GitHub RCE flaw lets attackers run code via simple pushSecurityWeek
- CVE-2026-3854 flaw lets attackers run code via simple git pushSecurity Affairs
- GitHub flaw (CVE-2026-3854) lets attackers run code via one pushThe Hacker News · first in our coverage