product-cna@github.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS product-cna@github.com
03
assessed vulnerabilities (107)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-96890US | high8.8 | — | ||
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to atta… | ||||
| CVE-2026-103620US | medium6.5OT elevated | — | ||
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch throu… | ||||
| CVE-2026-77987US | critical9.8 | — | ||
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-su… | ||||
| CVE-2026-77912US | medium5.4 | — | ||
A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendere… | ||||
| CVE-2026-75101US | medium6.5 | — | ||
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests… | ||||
| CVE-2026-76851US | high8.8 | — | ||
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation all… | ||||
| CVE-2026-19118US | high7.5 | — | ||
A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user… | ||||
| CVE-2026-18730US | high7.4 | — | ||
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbo… | ||||
| CVE-2026-15996US | high7.5 | — | ||
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of req… | ||||
| CVE-2026-17556US | critical9.1 | — | ||
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, includ… | ||||
| CVE-2026-15783US | —OT elevated | — | ||
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from privat… | ||||
| CVE-2026-15343US | — | — | ||
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to… | ||||
| CVE-2026-15007US | — | — | ||
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repository release notes… | ||||
| CVE-2026-14340US | medium5.0OT elevated | — | ||
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write… | ||||
| CVE-2026-10585US | medium5.4 | — | ||
A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbitrary JavaScript in another user's brow… | ||||
| CVE-2026-9132US | medium6.5OT elevated | — | ||
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have… | ||||
| CVE-2026-9106US | medium5.5 | — | ||
A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management.… | ||||
| CVE-2026-9312US | high8.2 | — | ||
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services… | ||||
| CVE-2026-8606US | medium5.9 | — | ||
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal servic… | ||||
| CVE-2026-8106US | medium6.1 | — | ||
A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query param… | ||||