Skip to content
Noroxi

GitHub records

163 published records for vendor GitHub. 0 of them have been exploited in the wild (listed in CISA KEV) and 1 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 0.6%
Pre-auth RCE
10
With a fix record
82.8%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

163 records
  • CVE-2024-0200
    61This week

    Unsafe Reflection in Github Enterprise Server leading to Command Injection

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    github · enterprise serverJan 16, 2024

  • CVE-2017-18365
    60This week

    The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to e

    CriticalCVSS 9.8WeaponizedEPSS 21%

    github · githubMar 28, 2019

  • CVE-2024-0507
    55Plan

    Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

    HighCVSS 8.8Proof of conceptEPSS 65%

    github · enterprise serverJan 16, 2024

  • CVE-2026-3854
    47Plan

    Remote code execution via git push option injection in GitHub Enterprise Server

    HighCVSS 8.7Proof of conceptEPSS 41%

    github · enterprise serverMar 10, 2026

  • CVE-2024-9487
    46Plan

    An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed

    CriticalCVSS 9.5Proof of conceptEPSS 25%

    github · enterprise serverOct 10, 2024

  • CVE-2024-4985
    41Plan

    An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication

    CriticalCVSS 10.0No exploitEPSS 2%

    github · enterprise serverMay 20, 2024

  • CVE-2022-24724
    40Plan

    Integer overflow in table parsing extension leads to heap memory corruption

    CriticalCVSS 9.8No exploitEPSS 4%

    github · cmark-gfmMar 3, 2022

  • CVE-2022-39321
    40Plan

    GitHub Actions Runner vulnerable to Docker Command Escaping

    CriticalCVSS 9.9No exploitEPSS 2%

    github · runnerOct 25, 2022

  • CVE-2026-9312
    39Monitor

    Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

    CriticalCVSS 9.2No exploitEPSS 9%

    github · enterprise serverMay 26, 2026

  • CVE-2020-10516
    39Monitor

    Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member

    CriticalCVSS 9.8No exploitEPSS 1%

    github · githubJun 3, 2020

  • CVE-2022-46255
    39Monitor

    Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE

    CriticalCVSS 9.8No exploitEPSS 1%

    github · enterprise serverDec 14, 2022

  • CVE-2024-22051
    39Monitor

    CommonMarker Integer Overflow Vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    github · cmark-gfmJan 4, 2024

  • CVE-2022-23739
    39Monitor

    Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-serv

    CriticalCVSS 9.8No exploitEPSS 1%

    github · enterprise serverJan 17, 2023

  • CVE-2021-22869
    39Monitor

    Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group

    CriticalCVSS 9.8No exploitEPSS 1%

    github · enterprise serverSep 24, 2021

  • CVE-2015-10031
    39Monitor

    purpleparrots 491-Project Highscore update.php sql injection

    CriticalCVSS 9.8No exploitEPSS 0%

    github · 491-projectJan 8, 2023

  • CVE-2024-6800
    38Monitor

    An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity

    CriticalCVSS 9.5No exploitEPSS 1%

    github · enterprise serverAug 20, 2024

  • CVE-2024-52308
    38Monitor

    Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

    CriticalCVSS 9.6No exploitEPSS 0%

    github · cliNov 14, 2024

  • CVE-2024-1374
    37Monitor

    Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

    CriticalCVSS 9.1No exploitEPSS 2%

    github · enterprise serverFeb 13, 2024

  • CVE-2024-1355
    37Monitor

    Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

    CriticalCVSS 9.1No exploitEPSS 2%

    github · enterprise serverFeb 13, 2024

  • CVE-2024-1378
    37Monitor

    Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

    CriticalCVSS 9.1No exploitEPSS 2%

    github · enterprise serverFeb 13, 2024

  • CVE-2024-1359
    37Monitor

    Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

    CriticalCVSS 9.1No exploitEPSS 2%

    github · enterprise serverFeb 13, 2024

  • CVE-2024-1372
    37Monitor

    Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

    CriticalCVSS 9.1No exploitEPSS 2%

    github · enterprise serverFeb 13, 2024

  • CVE-2024-1369
    37Monitor

    Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

    CriticalCVSS 9.1No exploitEPSS 2%

    github · enterprise serverFeb 13, 2024

  • CVE-2026-77987
    37Monitor

    GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

    CriticalCVSS 9.3No exploitEPSS 0%

    github · enterprise serverSep 22, 2026

  • CVE-2020-10518
    36Monitor

    Unsafe configuration options in GitHub Pages leading to remote code execution on GitHub Enterprise Server

    HighCVSS 8.8No exploitEPSS 3%

    github · githubAug 27, 2020