# GitHub Enterprise Server.

Every CVE that names GitHub Enterprise Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service](https://agentprime.io/advisories/CVE-2026-118237.md)
  `CVE-2026-118237` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console](https://agentprime.io/advisories/CVE-2026-110288.md)
  `CVE-2026-110288` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service](https://agentprime.io/advisories/CVE-2026-104608.md)
  `CVE-2026-104608` · CVE record: GitHub Enterprise Server · CVSS 7.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption, CWE-1265
- [Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts](https://agentprime.io/advisories/CVE-2026-96890.md)
  `CVE-2026-96890` · CVE record: GitHub Enterprise Server · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL](https://agentprime.io/advisories/CVE-2026-103620.md)
  `CVE-2026-103620` · CVE record: GitHub Enterprise Server · CVSS 6.0 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision](https://agentprime.io/advisories/CVE-2026-75101.md)
  `CVE-2026-75101` · CVE record: GitHub Enterprise Server · CVSS 6.0 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline](https://agentprime.io/advisories/CVE-2026-77912.md)
  `CVE-2026-77912` · CVE record: GitHub Enterprise Server · CVSS 7.4 High · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery](https://agentprime.io/advisories/CVE-2026-77987.md)
  `CVE-2026-77987` · CVE record: GitHub Enterprise Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-208
- [Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services](https://agentprime.io/advisories/CVE-2026-76851.md)
  `CVE-2026-76851` · CVE record: GitHub Enterprise Server · CVSS 7.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution](https://agentprime.io/advisories/CVE-2026-19118.md)
  `CVE-2026-19118` · CVE record: GitHub Enterprise Server · CVSS 7.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Race condition
- [Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token](https://agentprime.io/advisories/CVE-2026-18730.md)
  `CVE-2026-18730` · CVE record: GitHub Enterprise Server · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters](https://agentprime.io/advisories/CVE-2026-15996.md)
  `CVE-2026-15996` · CVE record: GitHub Enterprise Server · CVSS 6.6 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service
- [Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header](https://agentprime.io/advisories/CVE-2026-17556.md)
  `CVE-2026-17556` · CVE record: GitHub Enterprise Server · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Path traversal
- [Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites](https://agentprime.io/advisories/CVE-2026-15783.md)
  `CVE-2026-15783` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control
- [Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths](https://agentprime.io/advisories/CVE-2026-15343.md)
  `CVE-2026-15343` · CVE record: GitHub Enterprise Server · CVSS 8.6 High · Not analysed yet · Published 17 Jul 2026 · Tags: Path traversal
- [Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration](https://agentprime.io/advisories/CVE-2026-15007.md)
  `CVE-2026-15007` · CVE record: GitHub Enterprise Server · CVSS 5.7 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Denial of service
- [An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories](https://agentprime.io/advisories/CVE-2026-14340.md)
  `CVE-2026-14340` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control
- [Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category](https://agentprime.io/advisories/CVE-2026-10585.md)
  `CVE-2026-10585` · CVE record: GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint](https://agentprime.io/advisories/CVE-2026-9132.md)
  `CVE-2026-9132` · CVE record: GitHub Enterprise Server · CVSS 6.0 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen](https://agentprime.io/advisories/CVE-2026-9106.md)
  `CVE-2026-9106` · CVE record: GitHub Enterprise Server · CVSS 4.8 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-451
- [Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint](https://agentprime.io/advisories/CVE-2026-9312.md)
  `CVE-2026-9312` · CVE record: GitHub Enterprise Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint](https://agentprime.io/advisories/CVE-2026-8606.md)
  `CVE-2026-8606` · CVE record: GitHub Enterprise Server · CVSS 7.0 High · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft](https://agentprime.io/advisories/CVE-2026-8106.md)
  `CVE-2026-8106` · CVE record: GitHub Enterprise Server · CVSS 5.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Cross-site scripting (XSS)
- [Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion](https://agentprime.io/advisories/CVE-2026-8034.md)
  `CVE-2026-8034` · CVE record: GitHub Enterprise Server · CVSS 7.9 High · Not analysed yet · Published 7 May 2026 · Tags: Server-side request forgery (SSRF), CWE-436
- [Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint](https://agentprime.io/advisories/CVE-2026-7541.md)
  `CVE-2026-7541` · CVE record: GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Denial of service
- [Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider](https://agentprime.io/advisories/CVE-2026-6736.md)
  `CVE-2026-6736` · CVE record: GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Authentication bypass
- [Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2026-5845.md)
  `CVE-2026-5845` · CVE record: GitHub Enterprise Server · CVSS 7.2 High · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control
- [Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers](https://agentprime.io/advisories/CVE-2026-3307.md)
  `CVE-2026-3307` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Broken access control
- [Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API](https://agentprime.io/advisories/CVE-2026-5512.md)
  `CVE-2026-5512` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure
- [Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass](https://agentprime.io/advisories/CVE-2026-4296.md)
  `CVE-2026-4296` · CVE record: GitHub Enterprise Server · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-185
- [Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack](https://agentprime.io/advisories/CVE-2026-5921.md)
  `CVE-2026-5921` · CVE record: GitHub Enterprise Server · CVSS 8.9 High · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope](https://agentprime.io/advisories/CVE-2026-3582.md)
  `CVE-2026-3582` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Broken access control
- [Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection](https://agentprime.io/advisories/CVE-2026-2266.md)
  `CVE-2026-2266` · CVE record: GitHub Enterprise Server · CVSS 7.4 High · Not analysed yet · Published 10 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access](https://agentprime.io/advisories/CVE-2026-3306.md)
  `CVE-2026-3306` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Broken access control
- [Remote code execution via git push option injection in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2026-3854.md)
  `CVE-2026-3854` · CVE record: GitHub Enterprise Server · CVSS 8.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.42 · Not analysed yet · Published 10 Mar 2026 · Tags: Command injection
- [Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests](https://agentprime.io/advisories/CVE-2026-1999.md)
  `CVE-2026-1999` · CVE record: GitHub Enterprise Server · CVSS 7.1 High · Not analysed yet · Published 18 Feb 2026 · Tags: Broken access control
- [Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports](https://agentprime.io/advisories/CVE-2026-1355.md)
  `CVE-2026-1355` · CVE record: GitHub Enterprise Server · CVSS 6.0 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Broken access control
- [Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution](https://agentprime.io/advisories/CVE-2026-0573.md)
  `CVE-2026-0573` · CVE record: GitHub Enterprise Server · CVSS 7.6 High · Not analysed yet · Published 18 Feb 2026 · Tags: Open redirect
- [Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML](https://agentprime.io/advisories/CVE-2025-13744.md)
  `CVE-2025-13744` · CVE record: GitHub Enterprise Server · CVSS 8.4 High · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests](https://agentprime.io/advisories/CVE-2025-14046.md)
  `CVE-2025-14046` · CVE record: GitHub Enterprise Server · CVSS 8.6 High · Not analysed yet · Published 11 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation](https://agentprime.io/advisories/CVE-2025-11578.md)
  `CVE-2025-11578` · CVE record: GitHub Enterprise Server · CVSS 7.5 High · Not analysed yet · Published 10 Nov 2025 · Tags: Path traversal
- [DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers](https://agentprime.io/advisories/CVE-2025-11892.md)
  `CVE-2025-11892` · CVE record: GitHub Enterprise Server · CVSS 8.6 High · Not analysed yet · Published 10 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access](https://agentprime.io/advisories/CVE-2025-8447.md)
  `CVE-2025-8447` · CVE record: GitHub Enterprise Server · CVSS 7.0 High · Not analysed yet · Published 26 Aug 2025 · Tags: Broken access control
- [Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access](https://agentprime.io/advisories/CVE-2025-6981.md)
  `CVE-2025-6981` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Broken access control
- [GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API](https://agentprime.io/advisories/CVE-2025-6600.md)
  `CVE-2025-6600` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.3 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: Information disclosure
- [Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers](https://agentprime.io/advisories/CVE-2025-3246.md)
  `CVE-2025-3246` · CVE record: GitHub GitHub Enterprise Server · CVSS 8.6 High · Not analysed yet · Published 17 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation](https://agentprime.io/advisories/CVE-2025-3509.md)
  `CVE-2025-3509` · CVE record: GitHub Enterprise Server · CVSS 7.1 High · Not analysed yet · Published 17 Apr 2025 · Tags: Code injection
- [Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names](https://agentprime.io/advisories/CVE-2025-3124.md)
  `CVE-2025-3124` · CVE record: GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Broken access control
- [Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling](https://agentprime.io/advisories/CVE-2024-10001.md)
  `CVE-2024-10001` · CVE record: GitHub Enterprise Server · CVSS 7.1 High · Not analysed yet · Published 29 Jan 2025 · Tags: Code injection
- [Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation](https://agentprime.io/advisories/CVE-2025-23369.md)
  `CVE-2025-23369` · CVE record: GitHub Enterprise Server · CVSS 7.6 High · Not analysed yet · Published 21 Jan 2025 · Tags: Weak cryptography or TLS
- [Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access](https://agentprime.io/advisories/CVE-2024-8810.md)
  `CVE-2024-8810` · CVE record: GitHub Enterprise Server · CVSS 8.7 High · Not analysed yet · Published 7 Nov 2024 · Tags: Privilege escalation
- [Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data](https://agentprime.io/advisories/CVE-2024-10824.md)
  `CVE-2024-10824` · CVE record: GitHub Enterprise Server · CVSS 6.0 Medium · Not analysed yet · Published 7 Nov 2024 · Tags: Broken access control
- [Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation](https://agentprime.io/advisories/CVE-2024-10007.md)
  `CVE-2024-10007` · CVE record: GitHub Enterprise Server · CVSS 8.7 High · Not analysed yet · Published 7 Nov 2024 · Tags: Path traversal
- [Information disclosure in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-9539.md)
  `CVE-2024-9539` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.7 Medium · Not analysed yet · Published 11 Oct 2024 · Tags: Information disclosure
- [An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature…](https://agentprime.io/advisories/CVE-2024-9487.md)
  `CVE-2024-9487` · CVE record: GitHub Enterprise Server · CVSS 9.5 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 10 Oct 2024 · Tags: Weak cryptography or TLS
- [Improper privilege management in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-8263.md)
  `CVE-2024-8263` · CVE record: GitHub GitHub Enterprise Server · CVSS 6.2 Medium · Not analysed yet · Published 23 Sept 2024 · Tags: Privilege escalation
- [Cross-site scripting in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-8770.md)
  `CVE-2024-8770` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.8 Medium · Not analysed yet · Published 23 Sept 2024 · Tags: Cross-site scripting (XSS)
- [Improper signature verification in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-6800.md)
  `CVE-2024-6800` · CVE record: GitHub GitHub Enterprise Server · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2024 · Tags: Weak cryptography or TLS
- [Incorrect Authorization allows read access to issues in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-6337.md)
  `CVE-2024-6337` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.9 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control
- [Incorrect authorization in GitHub Enterprise Server](https://agentprime.io/advisories/CVE-2024-7711.md)
  `CVE-2024-7711` · CVE record: GitHub GitHub Enterprise Server · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control

Older: <https://agentprime.io/advisories/technology/github-enterprise-server.md?cursor=WyIyMDI0LTA4LTIwVDE5OjE3OjM3Ljc3NjAwMFoiLCJDVkUtMjAyNC03NzExIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=github-enterprise-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/github-enterprise-server/>. Everything for agents: <https://agentprime.io/llms.txt>.