github security advisories
10 threat alerts tracking vulnerabilities and security advisories that affect github products.
Vulnios monitors github CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent github security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-6800 — github — enterprise_server
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation meta
criticalCVE-2024-6800Critical Vulnerability: CVE-2026-5845 — github — enterprise_server
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the inte
criticalCVE-2026-5845Critical Vulnerability: CVE-2026-8034 — github — enterprise_server
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusio
criticalCVE-2026-8034Critical Vulnerability: CVE-2025-11892 — github — enterprise_server
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege esca
criticalCVE-2025-11892Critical Vulnerability: CVE-2026-77987 — github — enterprise_server
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did n
criticalCVE-2026-77987Critical Vulnerability: CVE-2026-17556 — github — enterprise_server
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user
criticalCVE-2026-17556Critical Vulnerability: CVE-2024-22051 — github, gjtorikian — cmark-gfm, commonmarker
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, pote
criticalCVE-2024-22051Critical Vulnerability: CVE-2021-22869 — github — enterprise_server
An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self
criticalCVE-2021-22869Critical Vulnerability: CVE-2020-10516 — github — github
An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories wit
criticalCVE-2020-10516Critical Vulnerability: CVE-2017-18365 — github — github
The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise se
criticalCVE-2017-18365
Track github exposure across your environment
Vulnios automatically cross-references your asset inventory against new github CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan