{"items":[{"id":"CVE-2026-118237","published":"2026-11-03T22:51:42.155Z","updated":"2026-11-06T19:09:30.593Z","title":"Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-110288","published":"2026-11-03T22:50:39.115Z","updated":"2026-11-06T19:10:00.855Z","title":"Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00187,"kevAdded":null},{"id":"CVE-2026-104608","published":"2026-11-03T22:49:48.079Z","updated":"2026-11-06T19:10:37.408Z","title":"Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service","severity":"HIGH","score":7.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-96890","published":"2026-10-06T18:56:46.136Z","updated":"2026-10-07T16:32:36.236Z","title":"Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts","severity":"HIGH","score":8.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-103620","published":"2026-10-06T18:56:41.101Z","updated":"2026-10-07T16:32:08.448Z","title":"Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL","severity":"MEDIUM","score":6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-75101","published":"2026-09-22T20:43:59.193Z","updated":"2026-09-23T15:04:47.704Z","title":"Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision","severity":"MEDIUM","score":6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-77912","published":"2026-09-22T20:43:56.061Z","updated":"2026-09-23T15:05:17.200Z","title":"Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline","severity":"HIGH","score":7.4,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2026-77987","published":"2026-09-22T20:43:53.715Z","updated":"2026-09-23T15:26:58.923Z","title":"GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery","severity":"CRITICAL","score":9.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00878,"kevAdded":null},{"id":"CVE-2026-76851","published":"2026-09-01T21:55:10.149Z","updated":"2026-09-02T13:09:26.107Z","title":"Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services","severity":"HIGH","score":7.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00829,"kevAdded":null},{"id":"CVE-2026-19118","published":"2026-09-01T21:55:04.441Z","updated":"2026-09-02T14:11:10.293Z","title":"Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution","severity":"HIGH","score":7.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00911,"kevAdded":null},{"id":"CVE-2026-18730","published":"2026-09-01T21:54:58.397Z","updated":"2026-09-22T21:07:46.233Z","title":"Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token","severity":"HIGH","score":8.2,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-18428","published":"2026-08-13T17:32:48.455Z","updated":"2026-08-13T17:57:51.408Z","title":"SQL Query Validation Bypass in OpenSearch Direct Query","severity":"HIGH","score":8.7,"vendor":"AWS","product":"Opensearch","kev":false,"epss":0.00999,"kevAdded":null},{"id":"CVE-2026-18952","published":"2026-08-12T18:42:38.633Z","updated":"2026-08-21T18:22:28.717Z","title":"Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin","severity":"HIGH","score":8.6,"vendor":"AWS","product":"Opensearch","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2026-19311","published":"2026-08-12T18:34:02.669Z","updated":"2026-08-13T14:53:00.212Z","title":"Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin","severity":"HIGH","score":8.6,"vendor":"AWS","product":"OpenSearch","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2026-15996","published":"2026-08-05T20:12:57.955Z","updated":"2026-08-06T13:48:59.999Z","title":"Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters","severity":"MEDIUM","score":6.6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00766,"kevAdded":null},{"id":"CVE-2026-17556","published":"2026-08-05T20:05:53.800Z","updated":"2026-08-06T13:11:06.407Z","title":"Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00805,"kevAdded":null},{"id":"CVE-2026-47427","published":"2026-07-28T15:32:27.294Z","updated":"2026-07-28T17:31:19.108Z","title":"GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler","severity":"HIGH","score":7.5,"vendor":"github","product":"github-mcp-server","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2026-54163","published":"2026-07-17T20:19:18.186Z","updated":"2026-07-20T17:45:49.353Z","title":"secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input","severity":"MEDIUM","score":4.7,"vendor":"github","product":"secure_headers","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-15783","published":"2026-07-17T15:20:23.081Z","updated":"2026-07-17T16:55:53.667Z","title":"Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-15343","published":"2026-07-17T15:18:46.037Z","updated":"2026-11-03T22:48:24.812Z","title":"Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths","severity":"HIGH","score":8.6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.01195,"kevAdded":null},{"id":"CVE-2026-15007","published":"2026-07-17T15:16:02.252Z","updated":"2026-07-17T16:39:17.312Z","title":"Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration","severity":"MEDIUM","score":5.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00636,"kevAdded":null},{"id":"CVE-2026-14340","published":"2026-07-01T21:03:00.726Z","updated":"2026-07-02T15:54:43.817Z","title":"An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-10585","published":"2026-06-30T21:39:02.311Z","updated":"2026-07-01T15:36:59.198Z","title":"Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-9132","published":"2026-06-30T20:23:37.445Z","updated":"2026-07-01T15:37:50.129Z","title":"Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint","severity":"MEDIUM","score":6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-9106","published":"2026-06-30T20:21:12.484Z","updated":"2026-07-01T15:37:28.521Z","title":"UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen","severity":"MEDIUM","score":4.8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-48529","published":"2026-06-26T16:33:32.688Z","updated":"2026-06-27T02:43:34.588Z","title":"GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion","severity":"MEDIUM","score":6,"vendor":"github","product":"github-mcp-server","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-9312","published":"2026-05-27T00:02:32.159Z","updated":"2026-06-30T20:53:28.093Z","title":"Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint","severity":"CRITICAL","score":9.2,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0916,"kevAdded":null},{"id":"CVE-2026-8606","published":"2026-05-26T23:59:41.742Z","updated":"2026-05-27T13:50:10.475Z","title":"Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint","severity":"HIGH","score":7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2026-45033","published":"2026-05-13T15:45:26.751Z","updated":"2026-05-13T18:38:57.370Z","title":"GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor","severity":"HIGH","score":8.5,"vendor":"github","product":"copilot-cli","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-8106","published":"2026-05-07T21:18:59.259Z","updated":"2026-05-08T13:07:33.764Z","title":"Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft","severity":"MEDIUM","score":5.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00164,"kevAdded":null},{"id":"CVE-2026-8034","published":"2026-05-07T21:18:49.812Z","updated":"2026-05-08T13:03:12.627Z","title":"Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion","severity":"HIGH","score":7.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0052,"kevAdded":null},{"id":"CVE-2026-7541","published":"2026-05-07T21:18:35.655Z","updated":"2026-05-08T13:44:52.426Z","title":"Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-6736","published":"2026-05-07T21:14:33.490Z","updated":"2026-05-08T13:57:18.111Z","title":"Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-5845","published":"2026-04-21T22:42:13.198Z","updated":"2026-04-22T18:04:05.173Z","title":"Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server","severity":"HIGH","score":7.2,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-3307","published":"2026-04-21T22:23:25.045Z","updated":"2026-04-22T18:00:21.619Z","title":"Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewers","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-5512","published":"2026-04-21T22:12:58.344Z","updated":"2026-04-22T17:39:01.520Z","title":"Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy API","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-4296","published":"2026-04-21T22:12:45.356Z","updated":"2026-04-22T13:16:53.004Z","title":"Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass","severity":"HIGH","score":7.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-5921","published":"2026-04-21T22:11:02.077Z","updated":"2026-04-22T13:18:03.644Z","title":"Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack","severity":"HIGH","score":8.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2026-3582","published":"2026-03-10T18:56:56.506Z","updated":"2026-03-11T14:13:44.860Z","title":"Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-2266","published":"2026-03-10T18:55:38.673Z","updated":"2026-03-11T14:15:09.704Z","title":"Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injection","severity":"HIGH","score":7.4,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-3306","published":"2026-03-10T17:46:57.090Z","updated":"2026-03-11T14:17:24.504Z","title":"Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write access","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-3854","published":"2026-03-10T17:37:34.890Z","updated":"2026-04-29T03:55:48.782Z","title":"Remote code execution via git push option injection in GitHub Enterprise Server","severity":"HIGH","score":8.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.41936,"kevAdded":null},{"id":"CVE-2026-29783","published":"2026-03-06T16:39:27.424Z","updated":"2026-11-03T22:13:23.016Z","title":"GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution","severity":"HIGH","score":7.5,"vendor":"github","product":"copilot-cli","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2018-25188","published":"2026-03-06T12:19:14.404Z","updated":"2026-03-09T19:00:10.242Z","title":"Webiness Inventory 2.3 SQL Injection via WsModelGrid.php","severity":"HIGH","score":8.8,"vendor":"Github","product":"Webiness Inventory","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-1999","published":"2026-02-18T20:44:51.396Z","updated":"2026-04-14T15:09:57.585Z","title":"Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requests","severity":"HIGH","score":7.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-1355","published":"2026-02-18T20:42:07.180Z","updated":"2026-02-20T19:36:28.885Z","title":"Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports","severity":"MEDIUM","score":6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-0573","published":"2026-02-18T20:37:39.601Z","updated":"2026-02-18T21:20:02.732Z","title":"Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code execution","severity":"HIGH","score":7.6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00736,"kevAdded":null},{"id":"CVE-2025-13744","published":"2026-01-06T20:44:02.712Z","updated":"2026-01-06T21:02:33.455Z","title":"Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML","severity":"HIGH","score":8.4,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2025-14046","published":"2025-12-11T17:52:05.353Z","updated":"2025-12-11T18:48:17.846Z","title":"Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests","severity":"HIGH","score":8.6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00386,"kevAdded":null},{"id":"CVE-2025-11578","published":"2025-11-10T22:44:33.200Z","updated":"2025-12-02T20:08:21.684Z","title":"Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation","severity":"HIGH","score":7.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00707,"kevAdded":null},{"id":"CVE-2025-11892","published":"2025-11-10T22:43:41.790Z","updated":"2025-11-12T20:12:21.125Z","title":"DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers","severity":"HIGH","score":8.6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00699,"kevAdded":null},{"id":"CVE-2025-8447","published":"2025-08-26T01:42:37.424Z","updated":"2025-08-26T18:34:59.232Z","title":"Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access","severity":"HIGH","score":7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2025-6981","published":"2025-07-15T20:44:30.022Z","updated":"2025-07-16T19:04:18.464Z","title":"Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized read-only access","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-6600","published":"2025-07-01T18:56:45.625Z","updated":"2025-07-01T19:38:49.147Z","title":"GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2025-3246","published":"2025-04-17T22:50:22.215Z","updated":"2025-04-18T12:01:53.671Z","title":"Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggers","severity":"HIGH","score":8.6,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2025-3509","published":"2025-04-17T22:50:18.437Z","updated":"2025-06-18T21:07:05.883Z","title":"Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation","severity":"HIGH","score":7.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.01314,"kevAdded":null},{"id":"CVE-2025-3124","published":"2025-04-17T22:50:14.017Z","updated":"2025-04-18T12:02:10.223Z","title":"Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2024-10001","published":"2025-01-29T18:24:58.816Z","updated":"2025-02-12T16:49:49.740Z","title":"Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling","severity":"HIGH","score":7.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2025-24362","published":"2025-01-24T18:04:45.674Z","updated":"2025-03-31T13:47:02.009Z","title":"CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts","severity":"HIGH","score":7.1,"vendor":"github","product":"codeql-action","kev":false,"epss":0.01236,"kevAdded":null},{"id":"CVE-2025-23369","published":"2025-01-21T18:46:30.711Z","updated":"2025-02-12T20:41:22.296Z","title":"Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation","severity":"HIGH","score":7.6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.01613,"kevAdded":null},{"id":"CVE-2024-8810","published":"2024-11-07T21:24:34.754Z","updated":"2024-11-08T15:47:50.811Z","title":"Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access","severity":"HIGH","score":8.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2024-10824","published":"2024-11-07T21:15:11.200Z","updated":"2024-11-08T15:48:41.503Z","title":"Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data","severity":"MEDIUM","score":6,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2024-10007","published":"2024-11-07T20:58:17.777Z","updated":"2024-11-08T15:50:55.912Z","title":"Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation","severity":"HIGH","score":8.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00844,"kevAdded":null},{"id":"CVE-2024-9539","published":"2024-10-11T17:52:35.386Z","updated":"2024-10-11T18:43:42.224Z","title":"An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata…","severity":"MEDIUM","score":5.7,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00638,"kevAdded":null},{"id":"CVE-2024-9487","published":"2024-10-10T21:08:48.720Z","updated":"2024-10-11T15:34:07.811Z","title":"An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled","severity":"CRITICAL","score":9.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.25607,"kevAdded":null},{"id":"CVE-2024-8263","published":"2024-09-23T20:12:51.005Z","updated":"2024-09-23T20:36:38.566Z","title":"An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of nested tags. This…","severity":"MEDIUM","score":6.2,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2024-8770","published":"2024-09-23T20:09:01.746Z","updated":"2024-09-23T20:37:07.272Z","title":"A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal…","severity":"MEDIUM","score":5.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00371,"kevAdded":null},{"id":"CVE-2024-6800","published":"2024-08-20T19:21:31.409Z","updated":"2026-11-04T00:10:48.542Z","title":"An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers…","severity":"CRITICAL","score":9.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01527,"kevAdded":null},{"id":"CVE-2024-6337","published":"2024-08-20T19:19:49.193Z","updated":"2024-08-21T13:43:00.222Z","title":"Incorrect Authorization allows read access to issues in GitHub Enterprise Server","severity":"MEDIUM","score":5.9,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2024-7711","published":"2024-08-20T19:17:37.776Z","updated":"2024-08-20T19:46:55.283Z","title":"An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any…","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2024-6395","published":"2024-07-16T21:27:10.901Z","updated":"2024-08-01T21:41:03.389Z","title":"GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2024-6336","published":"2024-07-16T21:27:07.393Z","updated":"2024-08-01T21:33:05.420Z","title":"Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure","severity":"MEDIUM","score":6.9,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2024-5817","published":"2024-07-16T21:27:03.820Z","updated":"2024-08-01T21:25:02.832Z","title":"Improper authorization allows read access to issue content in GitHub Enterprise Server","severity":"MEDIUM","score":5.9,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2024-5816","published":"2024-07-16T21:27:00.491Z","updated":"2024-08-01T21:25:02.923Z","title":"Improper authorization allows persistent access in GitHub Enterprise Server","severity":"MEDIUM","score":6.9,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00507,"kevAdded":null},{"id":"CVE-2024-5815","published":"2024-07-16T21:26:57.404Z","updated":"2024-08-01T21:25:02.739Z","title":"Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository","severity":"MEDIUM","score":6.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2024-5795","published":"2024-07-16T21:26:54.243Z","updated":"2024-08-01T21:25:01.600Z","title":"Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion","severity":"HIGH","score":7.7,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2024-5566","published":"2024-07-16T21:26:46.902Z","updated":"2024-08-01T21:18:06.292Z","title":"Improper Privilege Management allows for access to unauthorized repository content during migration","severity":"MEDIUM","score":5.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2024-5746","published":"2024-06-20T21:31:37.111Z","updated":"2024-08-01T21:18:07.077Z","title":"A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain…","severity":"HIGH","score":7.6,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00861,"kevAdded":null},{"id":"CVE-2024-4985","published":"2024-05-20T21:17:27.315Z","updated":"2024-08-01T20:55:10.505Z","title":"An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional…","severity":"CRITICAL","score":10,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02573,"kevAdded":null},{"id":"CVE-2024-2440","published":"2024-04-19T17:02:29.144Z","updated":"2024-08-01T19:11:53.576Z","title":"Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions","severity":"MEDIUM","score":5.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2024-3684","published":"2024-04-19T14:25:24.638Z","updated":"2024-08-01T20:20:00.537Z","title":"Improper Privilege Management was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console","severity":"HIGH","score":8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.01095,"kevAdded":null},{"id":"CVE-2024-3646","published":"2024-04-19T14:21:47.779Z","updated":"2024-08-01T20:20:00.135Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console","severity":"HIGH","score":8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.01742,"kevAdded":null},{"id":"CVE-2024-3470","published":"2024-04-19T14:17:47.071Z","updated":"2024-08-01T20:12:07.311Z","title":"Repository administrator can bypass organization's ruleset using deploy keys","severity":"MEDIUM","score":5.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2024-2748","published":"2024-03-20T23:09:40.032Z","updated":"2024-08-02T19:20:10.085Z","title":"CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user","severity":"MEDIUM","score":4.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00189,"kevAdded":null},{"id":"CVE-2024-2443","published":"2024-03-20T23:04:23.899Z","updated":"2024-08-27T19:36:36.453Z","title":"Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.02086,"kevAdded":null},{"id":"CVE-2024-2469","published":"2024-03-20T22:56:03.451Z","updated":"2025-04-10T20:16:44.625Z","title":"Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance","severity":"HIGH","score":8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.01616,"kevAdded":null},{"id":"CVE-2024-1908","published":"2024-02-29T18:23:21.156Z","updated":"2024-08-05T15:06:12.570Z","title":"Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2024-25129","published":"2024-02-22T18:23:33.228Z","updated":"2024-08-01T23:36:21.644Z","title":"Limited data exfiltration in CodeQL CLI","severity":"LOW","score":2.7,"vendor":"github","product":"codeql-cli-binaries","kev":false,"epss":0.00773,"kevAdded":null},{"id":"CVE-2024-1482","published":"2024-02-14T20:04:47.981Z","updated":"2024-08-01T18:40:21.100Z","title":"Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution","severity":"HIGH","score":7.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2024-1378","published":"2024-02-13T18:54:29.943Z","updated":"2024-08-16T19:08:04.844Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02339,"kevAdded":null},{"id":"CVE-2024-1374","published":"2024-02-13T18:54:18.668Z","updated":"2025-05-09T18:18:30.616Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02632,"kevAdded":null},{"id":"CVE-2024-1372","published":"2024-02-13T18:54:03.413Z","updated":"2025-05-09T18:18:10.070Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02275,"kevAdded":null},{"id":"CVE-2024-1369","published":"2024-02-13T18:53:29.406Z","updated":"2024-08-27T19:10:24.405Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02275,"kevAdded":null},{"id":"CVE-2024-1359","published":"2024-02-13T18:52:27.176Z","updated":"2025-05-09T18:17:48.415Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02275,"kevAdded":null},{"id":"CVE-2024-1355","published":"2024-02-13T18:51:14.254Z","updated":"2025-03-24T19:19:35.984Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"CRITICAL","score":9.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.02363,"kevAdded":null},{"id":"CVE-2024-1354","published":"2024-02-13T18:50:44.852Z","updated":"2025-05-08T15:35:22.078Z","title":"Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console","severity":"HIGH","score":8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0172,"kevAdded":null},{"id":"CVE-2024-1082","published":"2024-02-13T18:47:10.591Z","updated":"2025-05-09T18:16:58.580Z","title":"Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0077,"kevAdded":null},{"id":"CVE-2024-1084","published":"2024-02-13T18:44:05.830Z","updated":"2024-08-01T18:26:30.428Z","title":"Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user…","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2024-0507","published":"2024-01-16T18:51:28.374Z","updated":"2024-10-22T15:50:55.430Z","title":"Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.658,"kevAdded":null},{"id":"CVE-2024-0200","published":"2024-01-16T18:50:48.931Z","updated":"2024-08-01T17:41:16.005Z","title":"Unsafe Reflection in Github Enterprise Server leading to Command Injection","severity":"HIGH","score":7.2,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.71725,"kevAdded":null},{"id":"CVE-2023-6847","published":"2023-12-21T20:46:07.362Z","updated":"2024-08-02T08:42:07.604Z","title":"Improper Authentication in GitHub Enterprise Server leading to Authentication Bypass for Public Repository Data","severity":"HIGH","score":7.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00815,"kevAdded":null},{"id":"CVE-2023-51380","published":"2023-12-21T20:45:48.028Z","updated":"2024-08-02T22:32:09.043Z","title":"Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server","severity":"LOW","score":2.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00467,"kevAdded":null},{"id":"CVE-2023-51379","published":"2023-12-21T20:45:46.269Z","updated":"2024-08-02T22:32:09.453Z","title":"Incorrect Authorization for Issue Comments in GitHub Enterprise Server","severity":"MEDIUM","score":4.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2023-46648","published":"2023-12-21T20:45:45.845Z","updated":"2024-08-02T20:53:20.919Z","title":"Insufficient Entropy in GitHub Enterprise Server Management Console Invitation Token","severity":"HIGH","score":8.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00744,"kevAdded":null},{"id":"CVE-2023-46649","published":"2023-12-21T20:45:43.763Z","updated":"2024-08-02T20:53:20.936Z","title":"Race Condition allows Administrative Access on Organization Repositories","severity":"MEDIUM","score":6.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00174,"kevAdded":null},{"id":"CVE-2023-6804","published":"2023-12-21T20:45:34.098Z","updated":"2024-11-27T18:41:27.790Z","title":"Improper Privilege Management allows for arbitrary workflows to be run","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2023-6803","published":"2023-12-21T20:45:27.233Z","updated":"2024-08-02T08:42:07.752Z","title":"Race Condition allows Unauthorized Outside Collaborator","severity":"MEDIUM","score":5.8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2023-6802","published":"2023-12-21T20:45:24.749Z","updated":"2024-09-13T14:55:25.219Z","title":"Sensitive Information in Log File in GitHub Enterprise Server","severity":"HIGH","score":7.2,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00719,"kevAdded":null},{"id":"CVE-2023-6746","published":"2023-12-21T20:45:23.261Z","updated":"2025-04-23T16:22:17.760Z","title":"Sensitive Information in Log File in GitHub Enterprise Server","severity":"HIGH","score":8.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2023-46645","published":"2023-12-21T20:45:23.178Z","updated":"2024-09-13T14:56:06.758Z","title":"Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site","severity":"MEDIUM","score":6.8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00791,"kevAdded":null},{"id":"CVE-2023-6690","published":"2023-12-21T20:45:19.285Z","updated":"2024-08-02T08:35:14.855Z","title":"A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to…","severity":"LOW","score":3.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2023-46647","published":"2023-12-21T20:45:17.664Z","updated":"2024-08-02T20:53:20.870Z","title":"Improper Privilege Management in GitHub Enterprise Server management console leads to privilege escalation","severity":"HIGH","score":8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00638,"kevAdded":null},{"id":"CVE-2023-46646","published":"2023-12-21T20:45:15.264Z","updated":"2024-11-27T18:41:53.394Z","title":"Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the \"Get a check run\" API…","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2023-23766","published":"2023-09-22T14:18:49.735Z","updated":"2024-09-24T14:29:38.315Z","title":"Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling","severity":"MEDIUM","score":4.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00742,"kevAdded":null},{"id":"CVE-2023-23763","published":"2023-09-01T14:23:42.930Z","updated":"2024-10-01T14:23:19.054Z","title":"Information disclosure in GitHub Enterprise Server leading to private repository leakage","severity":"MEDIUM","score":5.3,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00667,"kevAdded":null},{"id":"CVE-2023-23765","published":"2023-08-30T22:33:40.932Z","updated":"2024-09-27T14:22:23.490Z","title":"Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling","severity":"MEDIUM","score":4.8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2023-23764","published":"2023-07-27T20:45:19.973Z","updated":"2024-10-16T20:11:49.691Z","title":"Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling","severity":"MEDIUM","score":4.8,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2023-37463","published":"2023-07-13T19:22:16.654Z","updated":"2024-10-30T18:48:32.341Z","title":"Quadratic complexity bugs may lead to a denial of service","severity":"MEDIUM","score":6.4,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.00696,"kevAdded":null},{"id":"CVE-2023-23762","published":"2023-04-07T18:41:52.689Z","updated":"2025-02-10T15:20:05.018Z","title":"Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0064,"kevAdded":null},{"id":"CVE-2023-23761","published":"2023-04-07T18:41:47.038Z","updated":"2025-02-07T20:14:26.121Z","title":"Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists","severity":"HIGH","score":7.7,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2023-24824","published":"2023-03-31T22:01:18.220Z","updated":"2025-02-11T17:19:40.510Z","title":"Quadratic complexity may lead to a denial of service in cmark-gfm","severity":"MEDIUM","score":5.3,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.01036,"kevAdded":null},{"id":"CVE-2023-26485","published":"2023-03-31T22:01:16.350Z","updated":"2025-02-11T17:20:37.921Z","title":"Quadratic complexity may lead to a denial of service in cmark-gfm","severity":"MEDIUM","score":5.3,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.01029,"kevAdded":null},{"id":"CVE-2023-23760","published":"2023-03-08T18:43:51.187Z","updated":"2025-02-28T19:48:30.725Z","title":"Path traversal in GitHub Enterprise Server leading to remote code execution","severity":"MEDIUM","score":4.9,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2022-46257","published":"2023-03-07T00:00:00.000Z","updated":"2025-03-06T14:52:44.927Z","title":"Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names","severity":"MEDIUM","score":4.3,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2023-22381","published":"2023-03-02T20:54:34.191Z","updated":"2025-03-05T20:05:02.297Z","title":"Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions","severity":"MEDIUM","score":4.1,"vendor":"GitHub","product":"Enterprise Server","kev":false,"epss":0.00839,"kevAdded":null},{"id":"CVE-2023-22380","published":"2023-02-16T00:00:00.000Z","updated":"2025-03-19T15:35:56.135Z","title":"Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2023-22486","published":"2023-01-24T02:30:29.099Z","updated":"2025-03-10T21:20:44.634Z","title":"cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of service","severity":"LOW","score":3.5,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.01119,"kevAdded":null},{"id":"CVE-2023-22485","published":"2023-01-24T00:26:57.671Z","updated":"2025-03-10T21:20:51.304Z","title":"cmark-gfm out-of-bounds read in validate_protocol","severity":"MEDIUM","score":5.3,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.0073,"kevAdded":null},{"id":"CVE-2023-22484","published":"2023-01-23T22:42:57.790Z","updated":"2025-03-10T21:20:57.334Z","title":"Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of service","severity":"LOW","score":3.5,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.00966,"kevAdded":null},{"id":"CVE-2023-22483","published":"2023-01-23T22:36:14.574Z","updated":"2025-03-10T21:21:03.509Z","title":"cmark-gfm Quadratic complexity bugs may lead to a denial of service","severity":"LOW","score":3.5,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.01085,"kevAdded":null},{"id":"CVE-2022-23739","published":"2023-01-17T00:00:00.000Z","updated":"2025-04-08T20:17:33.773Z","title":"Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens","severity":"CRITICAL","score":9.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01278,"kevAdded":null},{"id":"CVE-2022-46258","published":"2023-01-09T00:00:00.000Z","updated":"2025-04-09T13:51:10.568Z","title":"Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2022-46256","published":"2022-12-14T00:00:00.000Z","updated":"2025-04-22T15:55:55.601Z","title":"Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.02094,"kevAdded":null},{"id":"CVE-2022-46255","published":"2022-12-14T00:00:00.000Z","updated":"2025-04-22T15:58:08.645Z","title":"Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE","severity":"CRITICAL","score":9.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01565,"kevAdded":null},{"id":"CVE-2022-23741","published":"2022-12-14T00:00:00.000Z","updated":"2025-04-22T16:09:01.149Z","title":"Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access","severity":"HIGH","score":7.2,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.0117,"kevAdded":null},{"id":"CVE-2022-23737","published":"2022-12-01T00:00:00.000Z","updated":"2025-04-24T14:32:04.210Z","title":"Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00768,"kevAdded":null},{"id":"CVE-2022-23740","published":"2022-11-23T00:00:00.000Z","updated":"2025-04-28T14:18:58.847Z","title":"Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code Execution","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01219,"kevAdded":null},{"id":"CVE-2022-23738","published":"2022-11-01T00:00:00.000Z","updated":"2025-05-06T14:35:41.946Z","title":"Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files","severity":"MEDIUM","score":5.7,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.0081,"kevAdded":null},{"id":"CVE-2022-23734","published":"2022-10-19T00:00:00.000Z","updated":"2025-05-09T14:50:32.354Z","title":"Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.02757,"kevAdded":null},{"id":"CVE-2022-39209","published":"2022-09-15T00:00:00.000Z","updated":"2025-04-23T17:10:11.051Z","title":"Uncontrolled Resource Consumption in cmark-gfm","severity":"HIGH","score":7.5,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.02151,"kevAdded":null},{"id":"CVE-2022-23733","published":"2022-08-02T16:05:14.000Z","updated":"2024-08-03T03:51:45.926Z","title":"Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes","severity":"MEDIUM","score":5.4,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2022-31026","published":"2022-06-06T21:05:14.000Z","updated":"2025-04-23T18:18:51.825Z","title":"Use of Uninitialized Variable in trilogy","severity":"MEDIUM","score":5.9,"vendor":"github","product":"trilogy","kev":false,"epss":0.01094,"kevAdded":null},{"id":"CVE-2022-23732","published":"2022-04-05T00:10:11.000Z","updated":"2024-08-03T03:51:46.012Z","title":"Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01739,"kevAdded":null},{"id":"CVE-2022-24724","published":"2022-03-03T19:35:09.000Z","updated":"2025-04-22T18:20:59.594Z","title":"Integer overflow in table parsing extension leads to heap memory corruption","severity":"HIGH","score":8.8,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.0451,"kevAdded":null},{"id":"CVE-2022-24722","published":"2022-03-02T22:40:11.000Z","updated":"2025-04-23T18:59:13.837Z","title":"Cross-site Scripting in view_component","severity":"HIGH","score":8.1,"vendor":"github","product":"view_component","kev":false,"epss":0.01092,"kevAdded":null},{"id":"CVE-2021-41599","published":"2022-02-17T23:35:12.000Z","updated":"2024-08-04T03:15:29.207Z","title":"Improper control flow in GitHub Enterprise Server hosted Pages leads to remote code execution","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.02223,"kevAdded":null},{"id":"CVE-2021-41598","published":"2022-01-25T19:45:12.000Z","updated":"2024-08-04T03:15:29.207Z","title":"UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01152,"kevAdded":null},{"id":"CVE-2021-22870","published":"2021-11-10T01:55:11.000Z","updated":"2024-08-03T18:51:07.675Z","title":"Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01134,"kevAdded":null},{"id":"CVE-2021-22868","published":"2021-09-24T17:50:16.000Z","updated":"2024-08-03T18:51:07.475Z","title":"Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server","severity":"MEDIUM","score":4.3,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00929,"kevAdded":null},{"id":"CVE-2021-22869","published":"2021-09-24T17:50:10.000Z","updated":"2024-08-03T18:51:07.513Z","title":"Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group","severity":"CRITICAL","score":9.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01195,"kevAdded":null},{"id":"CVE-2021-37700","published":"2021-08-12T20:45:13.000Z","updated":"2024-08-04T01:23:01.457Z","title":"Clipboard-based DOM-XSS","severity":"MEDIUM","score":6.5,"vendor":"github","product":"paste-markdown","kev":false,"epss":0.0166,"kevAdded":null},{"id":"CVE-2021-22867","published":"2021-07-14T20:55:12.000Z","updated":"2024-08-03T18:51:07.486Z","title":"Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01171,"kevAdded":null},{"id":"CVE-2021-32638","published":"2021-05-25T17:10:11.000Z","updated":"2024-08-03T23:25:30.983Z","title":"CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated","severity":"MEDIUM","score":4.4,"vendor":"github","product":"codeql-action","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2021-22866","published":"2021-05-14T21:10:12.000Z","updated":"2024-08-03T18:51:07.627Z","title":"UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resources","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01045,"kevAdded":null},{"id":"CVE-2021-22865","published":"2021-04-02T17:25:14.000Z","updated":"2024-08-03T18:51:07.557Z","title":"Improper access control in GitHub Enterprise Server leading to unauthorized read access to private repository metadata","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01363,"kevAdded":null},{"id":"CVE-2021-22864","published":"2021-03-23T21:40:12.000Z","updated":"2024-08-03T18:51:07.560Z","title":"Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.02553,"kevAdded":null},{"id":"CVE-2021-22863","published":"2021-03-03T03:25:23.000Z","updated":"2024-08-03T18:51:07.572Z","title":"Improper access control in GitHub Enterprise Server leading to unauthorized changes to maintainer permissions on pull requests","severity":"HIGH","score":8.1,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01003,"kevAdded":null},{"id":"CVE-2021-22862","published":"2021-03-03T03:25:22.000Z","updated":"2024-08-03T18:51:07.479Z","title":"Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00839,"kevAdded":null},{"id":"CVE-2021-22861","published":"2021-03-03T03:25:21.000Z","updated":"2024-08-03T18:51:07.561Z","title":"Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories","severity":"MEDIUM","score":6.5,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.00952,"kevAdded":null},{"id":"CVE-2020-10519","published":"2021-03-03T03:25:21.000Z","updated":"2024-08-04T11:06:09.542Z","title":"Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.03099,"kevAdded":null},{"id":"CVE-2020-10517","published":"2020-08-27T21:55:16.000Z","updated":"2024-08-04T11:06:09.569Z","title":"Improper access control in GitHub Enterprise Server leading to the enumeration of private repository names","severity":"MEDIUM","score":4.3,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.0105,"kevAdded":null},{"id":"CVE-2020-10518","published":"2020-08-27T21:55:11.000Z","updated":"2024-08-04T11:06:09.883Z","title":"Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server","severity":"HIGH","score":8.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.03699,"kevAdded":null},{"id":"CVE-2020-5238","published":"2020-07-01T23:05:15.000Z","updated":"2024-08-04T08:22:09.078Z","title":"Denial of service in table parsing in cmark-gfm","severity":"MEDIUM","score":6.5,"vendor":"github","product":"cmark-gfm","kev":false,"epss":0.01566,"kevAdded":null},{"id":"CVE-2020-10516","published":"2020-06-03T13:31:24.000Z","updated":"2024-08-04T11:06:09.534Z","title":"Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member","severity":"CRITICAL","score":9.8,"vendor":"GitHub","product":"GitHub Enterprise Server","kev":false,"epss":0.01591,"kevAdded":null},{"id":"CVE-2019-16765","published":"2019-11-25T17:41:17.000Z","updated":"2024-08-05T01:24:47.950Z","title":"If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code…","severity":"HIGH","score":7.4,"vendor":"github","product":"vscode-codeql","kev":false,"epss":0.05364,"kevAdded":null}]}