G
Vendor security profile
github
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs24
Critical3
CISA KEV0
Public exploit1
Patch rate%25
Avg. CVSS7.4
12-month vulnerability rate
1
1
0
0
0
0
3
3
2
5
6
2
CVE KEV
CVE severity distribution
24toplam CVE
Critical3 (13%)
High12 (50%)
Medium9 (38%)
Patch and exploitation view
%25
Verified patch
%0
CISA KEV
%4
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
18Unknown
Latest vulnerabilities
8.7
CVE-2026-96890
Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
G
Patch status unknownEPSS %0
6.0
CVE-2026-103620
Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
G
Patch status unknownEPSS %0
5.3
CVE-2026-18825
Origin validation error in the connect-xcors npm package
G
Patch status unknownEPSS %0
6.0
CVE-2026-75101
Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision
G
Patch status unknownEPSS %0
7.4
CVE-2026-77912
Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline
G
Patch status unknownEPSS %0
9.3
CVE-2026-77987
GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
G
Patch status unknownEPSS %1
9.1
CVE-2026-55158
Conflibot: Command injection via crafted pull request branch names under pull_request_target
W
Patch verifiedEPSS %1
7.7
CVE-2026-76851
Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services
G
Patch status unknownEPSS %1
7.7
CVE-2026-19118
Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
G
Patch status unknownEPSS %1
8.2
CVE-2026-18730
Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
G
Patch status unknownEPSS %0