github

Top products

The 15 most recently published vulnerabilities affecting github.

• CVE-2026-47427GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler7.5Jul 28, 2026
• CVE-2026-54163secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input4.7Jul 17, 2026
• CVE-2026-14340An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories5.0Jul 1, 2026
• CVE-2026-10585Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category5.4Jun 30, 2026
• CVE-2026-9132Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint6.5Jun 30, 2026
• CVE-2026-9106UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen5.5Jun 30, 2026
• CVE-2026-48529GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion6.0Jun 26, 2026
• CVE-2026-48501GitHub CLI tokens leak via `gh attestation` commands7.4May 29, 2026
• CVE-2026-9312Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint8.2May 27, 2026
• CVE-2026-8606Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint5.9May 26, 2026
• CVE-2026-45803gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection3.5May 15, 2026
• CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor7.8May 13, 2026
• CVE-2026-8106Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft6.1May 7, 2026
• CVE-2026-8034Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion9.8May 7, 2026
• CVE-2026-7541Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint7.5May 7, 2026