Github
Monthly
Account pre-hijacking in the Prowler API (5.4.0 up to but not including 5.35.0) lets an unauthenticated remote attacker gain persistent control of a user account that has not yet registered, by self-registering the victim's email address before the real owner ever signs up or links single sign-on. Because social account linking in ProwlerSocialAccountAdapter.pre_social_login() matches a Google or GitHub login to any existing local account with the same email address without requiring the address to be verified by the provider or on the local account, the genuine owner's later social sign-in is silently connected to the attacker's pre-created account, and the attacker's original password remains valid, exposing cloud provider credentials, scan findings and tenant memberships held in that account. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though exploitation requires only open self-registration plus a victim who later authenticates through Google or GitHub (a race condition that closes once the legitimate owner has an account). The source assigns CVSS 4.0 7.6 (HIGH); our independent assessment scores it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Server-side request forgery in GitHub Enterprise Server 3.20, 3.21, and 3.22 lets an authenticated repository contributor with push permission cause the appliance to issue requests to attacker-controlled internal hosts, which can be chained to remote code execution on the appliance. The flaw sits in the secret scanning validator for GCP service account credentials, which trusts the token endpoint embedded in a committed credential and sends a request to it without restricting the destination, and it additionally requires GitHub Advanced Security with secret scanning validity checks enabled, a non-default configuration. No public exploit identified at time of analysis; vendor-released patches are 3.20.9, 3.21.7, and 3.22.2, and the issue was reported through the GitHub Bug Bounty program.
Stored cross-site scripting in GitHub Enterprise Server (3.17 through 3.22 series) allows an authenticated user to inject arbitrary HTML attributes through crafted Markdown that survives initial sanitization but is then re-interpreted by the rendering pipeline's quote-character rewriting step, letting the payload chain same-origin JavaScript gadgets to bypass Content Security Policy and seize control of the page DOM in a victim's browser. When a second user views the rendered content, the attacker can read content visible to that victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes, with the payload potentially propagating into any repository or organization where the victim holds write access. Exploitation requires an authenticated account and victim interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, vendor score 7.4), no public exploit code has been identified at time of analysis, and vendor-released patches exist in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
Server-side request forgery in the GitHub Enterprise Server notebook viewer allows a remote attacker to direct requests to internal services listening on non-standard ports of the same appliance, because the viewer validated a user-supplied URL's scheme and host but not its port. Response bodies are not returned, but response timing acts as an oracle that can be used to extract instance secrets character by character; an extracted secret can then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. All GitHub Enterprise Server versions 3.17 through 3.22 are affected; exploitation requires network access to the instance and is unauthenticated only when private mode is disabled, otherwise any authenticated user suffices, and no public exploit has been identified at time of analysis. Note that the independent assessment rates this as high difficulty (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), since full impact depends on a multi-step timing-oracle extraction succeeding and a usable internal service being reachable for the follow-on RCE.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.
Remote code execution via a time-of-check time-of-use race condition in GitHub Enterprise Server affects all versions prior to 3.22. An authenticated user holding repository write access can trigger the vulnerability by issuing precisely timed concurrent upload requests, exploiting the window between a security check and the file operation it guards. No public exploit code or CISA KEV listing has been identified; the issue was responsibly disclosed through GitHub's Bug Bounty program and patched across five active release branches.
SSRF in GitHub Enterprise Server (all versions prior to 3.22) allows unauthenticated network attackers to force the Manage API to issue gateway-to-agent requests toward an attacker-controlled host, and - by intercepting those outbound requests - capture a weakly-scoped HMAC token replayable against privileged management agent endpoints. The flaw arises from an unauthenticated cluster-configuration parsing endpoint combined with an HMAC scheme that signs only a timestamp, leaving request paths and bodies unsigned and the captured token replayable with arbitrary content. Vendor-released patches are available across five supported branches (3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbitrary code execution by any authenticated user holding async query access. The vulnerable component is the SQL query validation layer in the Flint extension, which fails to prevent crafted payloads from reaching and executing on Spark worker nodes. No public exploit code has been identified at time of analysis, but the network-reachable RCE primitive, low complexity, and low privilege requirement collectively make this a high-priority remediation target; vendor patches are available in OpenSearch 3.7.0 and 2.19.6.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file and directory deletion in GitHub Enterprise Server allows any network-reachable attacker to recursively destroy critical instance data - including Git LFS objects, release assets, issue attachments, and user avatars - by injecting a path traversal sequence into the X-GitHub-Request-Id HTTP request header. The vulnerability stems from using this header value unsanitized as a filesystem path component for an upload buffer directory; a deferred cleanup routine then recursively deletes whatever directory the traversal resolves to, including the entire user storage root. No public exploit has been identified at time of analysis and the CVE is not in the CISA KEV catalog, but the near-zero exploitation bar - no authentication, no user interaction, effective even with private mode enabled - makes this a critical priority for any organization running on-premises GitHub Enterprise Server.
Arbitrary file write in GitHub Enterprise Server (all releases before 3.22) lets an attacker who already has code execution inside the Dependabot updater container escape the intended dependency-file directory via path traversal and symlink manipulation, planting attacker-controlled files anywhere in a repository - including GitHub Actions workflows under .github/workflows/. Because path validation checked the declared rather than the effective (symlink-resolved) path, an injected workflow can run with the repository's Actions secrets when the repo uses pull_request_target or auto-merge. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 4.0 base score is 8.6 (High).
Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issuing crafted requests to internal services, reachable through an upload endpoint that fails to validate input. By injecting path-traversal content into request parameters, an attacker can redirect internal API calls to reach back-end services and harvest sensitive credentials. No public exploit identified at time of analysis; the issue was reported through the GitHub Bug Bounty program and carries a CVSS 4.0 base score of 9.2 (Critical), though the vector flags high attack complexity and an extra attack requirement that temper real-world ease of exploitation.
Server-Side Request Forgery in GitHub Enterprise Server lets an attacker coerce the appliance into issuing HTTP requests to internal services through the security advisories package-lookup feature, then use response-timing differences as an oracle to infer sensitive environment variables such as signing secrets and private keys. All versions prior to 3.21.1 are affected, and exploitation is unauthenticated on instances not running in private mode (GitHub Packages must be enabled), or available to any authenticated user otherwise. No public exploit identified at time of analysis; the issue was reported through the GitHub Bug Bounty program and carries a CVSS 4.0 base score of 7.0.
Server-side request forgery in GitHub Enterprise Server's notebook viewer enables remote unauthenticated attackers to access internal services and systems through URL parser confusion. The vulnerability exploits discrepancies between validation and request execution parsers, allowing crafted URLs to bypass hostname checks and target unintended internal hosts. All versions prior to 3.21 are affected, with patches available across supported release branches (3.16.18, 3.17.15, 3.18.9, 3.19.6, 3.20.2). CVSS 7.9 reflects high impact to subsequent system confidentiality, integrity, and availability. No active exploitation confirmed (not in CISA KEV); reported through GitHub Bug Bounty program.
Information disclosure via server-side request forgery in GitHub Enterprise Server (all versions prior to 3.21) lets an unauthenticated attacker read sensitive environment variables from the appliance. The notebook rendering service follows HTTP redirects without revalidating the destination host, so an attacker who chains the instance's open-redirect endpoint can reach internal services and, using regex filter queries against an internal API combined with response-timing measurement, exfiltrate secret values one character at a time. No public exploit is identified at time of analysis and EPSS is very low (0.05%), but SSVC rates the technical impact as total.
Improper authorization in GitHub Enterprise Server (GHES) lets an authenticated attacker abuse scoped user-to-server (ghu_) tokens to reach private repositories outside their intended GitHub App installation scope, including write access. The root cause is an authorization fallback that treated a revoked or deleted installation as a global installation context; chained with token-revocation timing and SSH push attribution, an attacker can obtain and reuse a victim-scoped token. It affects all GHES releases prior to 3.21 and was reported through the GitHub Bug Bounty program, with no public exploit identified at time of analysis.
OS command injection in GitHub Enterprise Server (all releases prior to 3.21) lets an authenticated Management Console administrator run arbitrary shell commands on the underlying appliance by embedding shell metacharacters in proxy configuration fields such as http_proxy. The flaw was reported through the GitHub Bug Bounty program and there is no public exploit identified at time of analysis; EPSS is negligible (0.01%, 3rd percentile) and CISA SSVC rates exploitation as none. Because it requires high-privilege console access, it is primarily a privilege-boundary escape from Management Console admin to full OS-level control rather than a remotely reachable pre-auth issue.
Account takeover in GitHub Enterprise Server (all versions prior to 3.21) is possible through an OAuth redirect URI validation bypass caused by a flawed regular expression (CWE-185). An attacker who knows a first-party OAuth application's registered callback URL can craft a malicious authorization link that leaks the victim's OAuth authorization code to an attacker-controlled domain, granting access to the victim's account with the scopes of that application. Reported via the GitHub Bug Bounty program; there is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records exploitation status as none.
Remote code execution in GitHub Enterprise Server allows authenticated users with repository push access to execute arbitrary code via unsanitized push option values that bypass internal header validation. An attacker can inject malicious metadata fields by exploiting insufficient input sanitization in the git push operation handler. This high-severity vulnerability affects GitHub Enterprise Server versions prior to 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3, with no patch currently available for all affected installations.
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by exploiting insufficient validation in the OAuth callback handler, enabling them to redirect repository access and create code records in arbitrary projects. Public exploit code exists for this vulnerability, and GitHub and OneUptime users remain at risk until patches are applied, as no fixes are currently available for the affected GitHub integration.
Arbitrary code execution in GitHub Copilot CLI versions <=0.0.422 allows attackers to bypass the agent's shell command safety classifier using bash parameter expansion operators (${var@P}, ${var=value}, ${!var}, and nested $(cmd)/<(cmd)). Attackers influencing agent inputs via prompt injection through repository files, MCP server responses, or user instructions can execute hidden commands disguised as read-only operations on the user's workstation. A detailed proof-of-concept is published in the GHSA advisory; EPSS is low (0.10%, 28th percentile) and the issue is not in CISA KEV, so no public exploit identified at time of analysis beyond the vendor-published PoC.
Improper authorization in Google Cloud Build GitHub Trigger allowing unauthenticated build execution. EPSS 0.19%.
Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrite the entire infrastructure configuration. PoC available.
Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables malicious PRs to execute code in the context of the base repository. PoC and patch available.
Arbitrary command execution in WPGraphQL's GitHub Actions workflow allows attackers with pull request creation privileges to inject shell commands through unvalidated pull request body content, potentially compromising the build environment and repository integrity. The vulnerability affects WPGraphQL versions prior to 2.9.1 and requires low privileges and user interaction to exploit. No patch is currently available for affected deployments.
Incorrect computation in CIRCL cryptographic library's CombinedMult function for secp384r1 (P-384) curve. Produces wrong elliptic curve multiplication results for specific inputs, potentially breaking ECDSA signature verification.
Arbitrary command execution in OpenClaw versions 2026.1.8 through 2026.2.13 allows attackers to execute shell commands when developers or CI systems run the update-clawtributors.ts maintenance script on repositories containing malicious commit metadata. The vulnerability stems from unsanitized interpolation of git author emails into shell commands via execSync, exploitable only by those with access to the development environment or source repository. Version 2026.2.14 patches the issue.
GitHub Enterprise Server allows authenticated webhook administrators to bypass network restrictions through Server-Side Request Forgery, enabling access to internal services, job queues, and sensitive endpoints on loopback addresses. This affects all versions prior to 3.20 and requires valid credentials with webhook configuration privileges. No patch is currently available, and exploitation could lead to unauthorized data access or disruption of background job processing.
URL redirection vulnerability in GitHub Enterprise Server allows attacker-controlled redirects through crafted URLs, potentially enabling credential theft via phishing.
Authenticated users can exploit a race condition in GitHub Copilot and Visual Studio Code to execute arbitrary code remotely by manipulating file state between verification and use. This vulnerability affects users with network access to these development tools and requires user interaction to trigger. No patch is currently available to address this high-severity flaw.
GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers to bypass security features over the network through improper neutralization of special command elements. The vulnerability requires user interaction to exploit and could enable attackers to execute arbitrary commands with high impact on confidentiality, integrity, and availability. No patch is currently available for this issue.
GitHub Copilot is vulnerable to command injection attacks that enable remote code execution without requiring authentication or user interaction beyond a click. An attacker can exploit this network-accessible vulnerability to execute arbitrary commands on affected systems. No patch is currently available for this high-severity vulnerability.
GitHub Copilot and Visual Studio 2022 contain a command injection vulnerability that allows authenticated users to execute arbitrary commands through improper sanitization of special elements. An attacker with valid credentials can leverage user interaction to escalate privileges and gain elevated access across the network. No patch is currently available for this vulnerability.
Remote code execution in GitHub Copilot and Visual Studio 2022 via command injection allows unauthenticated attackers to execute arbitrary code over the network with user interaction. The vulnerability stems from improper sanitization of special elements in commands, enabling attackers to break out of intended command contexts and inject malicious payloads. No patch is currently available for this high-severity issue affecting both development environments.
Command injection in GitHub Super-linter versions 6.0.0 through 8.3.0 allows attackers to execute arbitrary commands in workflow runner contexts by submitting pull requests with maliciously crafted filenames containing shell command substitution syntax. An attacker exploiting this vulnerability can access sensitive workflow credentials, including GITHUB_TOKEN, depending on permission configurations. The vulnerability affects Super-linter when used as a GitHub Action and has no available patch at this time.
PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enabling attackers to conduct login CSRF attacks against GitHub and Google login flows. An attacker can pre-authenticate a victim's session and trick them into logging into the attacker's account, causing the victim's data and academic progress to be stored on the attacker's account instead. Public exploit code exists for this vulnerability, and a patch is available.
Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. CVSS 10.0, PoC available.
github-kanban-mcp-server has a command injection in execAsync (EPSS 1.0%) enabling remote code execution on developer machines using the GitHub Kanban MCP integration.
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers to write arbitrary files to the server through malicious tar archives, bypassing incomplete path sanitization. Public exploit code exists for this vulnerability. The issue stems from improper validation of absolute paths in tar file entries, enabling potential code execution or service disruption on affected systems.
Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling arbitrary code execution with repository write permissions from fork PRs. PoC available, patch available.
ECDSA adaptor pre-signature verification in UltrafastSecp256k1 before 4.2.0 accepts forged adaptor pre-signatures whose r value is not cryptographically bound to the adaptor point T, allowing a malicious signing counterparty to produce a pre-signature that passes ecdsa_adaptor_verify even though it is not genuinely adaptable. This is an integrity-only cryptographic soundness flaw (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting deployments that use the library's ECDSA adaptor-signature path, such as atomic swaps, discreet log contracts, or payment channels. No public exploit code was identified at time of analysis, and it is fully fixed in 4.2.0.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows remote, unauthenticated attackers to manipulate database queries through the ID parameter of admin/delete1.php, a script the description treats as an unauthenticated action endpoint despite its location under the admin/ directory. Successful exploitation grants low-level confidentiality, integrity, and availability impact on the application's database, and publicly available exploit code exists, raising the likelihood of opportunistic scanning and abuse. The project is distributed via rolling releases with no versioned builds, the maintainer has not responded to the early issue report, so no vendor-released patch is available and every running instance should be considered affected; the practical risk is narrowed by the product's very low deployment footprint and the need for the endpoint to be reachable over the network.
A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.
SQL injection in OS4ED openSIS-Classic up to and including 9.3 lets an authenticated, highly privileged user manipulate the argument values reaching the db_properties function in functions/DatabaseInc.php, allowing crafted input to alter or extract database contents through the Save Data Handler code path. The flaw is network-reachable and needs no user interaction, but the CVSS vector requires PR:H, so anonymous or low-privilege accounts cannot reach it directly; publicly available exploit code exists via the project's public issue report. The vendor was notified through that issue and has not responded, so no vendor-released patch is identified at time of analysis, and the overall real-world risk is assessed as low despite the SQL injection class.
Authenticated SQL injection in OS4ED openSIS-Classic 9.3 and earlier allows a low-privileged user to manipulate the LO_sort argument in the Student List Search endpoint, which reaches the DBQuery function and can expose or alter database contents. The issue is remotely exploitable, requires a valid session (CVSS PR:L), and publicly available exploit code exists; there is no confirmed CISA KEV active exploitation. The affected release is a niche open-source PHP student information system, so real-world priority is modest despite the SQL injection class.
SQL injection in OS4ED openSIS-Classic (up to and including version 9.3) lets an authenticated low-privileged user - a staff or teacher account is sufficient - manipulate the 'cust' argument handled by functions/CustomFieldsFnc.php in the Student Search component and read or partially modify the backend database, including student records. Publicly available exploit code exists, and the vendor was notified through a public GitHub issue but has not responded, so no vendor-released patch is identified at time of analysis. This is a high-CVSS-but-moderate-real-risk issue: the requirement for a valid authenticated session and the product's education-sector, small-scale deployments meaningfully narrow the exposed population.
SQL injection in OS4ED openSIS-Classic up to and including version 9.3 lets an authenticated attacker with any valid low-privileged account run arbitrary SQL against the backend database by manipulating the Tables argument passed to DBQuery_assignment in modules/grades/Assignments.php. The endpoint is reachable over the network with no user interaction and no special configuration, and publicly available exploit code exists; however, exploitation requires a valid session (CVSS vector PR:L, and the assessed vector confirms PR:L), so anonymous internet-wide attacks are not possible, and no confirmed active exploitation (CISA KEV) has been reported. Real-world priority is therefore low-to-moderate, driven mainly by the authentication prerequisite and openSIS-Classic's limited deployment footprint.
Cross-site scripting in the Guest Book component of gedelumbung HospitalManagement (PHP) allows remote, unauthenticated attackers to inject script payloads through the nama, email, and pesan fields handled by the kirim function in application/modules/web/controllers/buku_tamu.php, with the payload executing when a victim loads the affected guest-book page (publicly available exploit code exists; no confirmed active exploitation). The project ships as a rolling release, so no discrete affected or fixed version numbers exist - any deployment at or before commit c2d45543789a3887067d3915f69d44cfc2cf76a8 is presumed vulnerable. Impact is limited: the maintainer has not responded to the issue report and no vendor patch is available, but the required victim interaction, the low CVSS 2.1 base score, and a niche installation base keep this a low-priority finding.
Improper authorization in the gedelumbung HospitalManagement configuration handler lets an authenticated high-privilege user write arbitrary configuration values through the sistem.php 'simpan' action without the application enforcing an adequate access-control check. Only deployments running the current rolling-release codebase are affected, since the project publishes no versioned releases and the CPE entry carries a wildcard version; the practical exposure is limited to Low confidentiality, integrity, and availability impact on configuration data rather than full host or data compromise. Publicly available exploit code exists via the project's GitHub issue tracker (issue #12), but there is no indication of confirmed active exploitation, and the EPSS-style risk signal remains modest; the attacker must already hold an administrative session (CVSS PR:H, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), which keeps real-world risk low despite the nominally elevated severity.
Information disclosure in gedelumbung HospitalManagement lets unauthenticated remote attackers obtain sensitive diagnostic output generated through the error_reporting handling in index.php, because PHP error text is emitted into HTTP responses. Exploitation requires only that the deployed instance runs with PHP error reporting/display enabled (the project's default or a common production misconfiguration) and that the attacker can remotely induce an error condition; no authentication or user interaction is needed (PR:N/UI:N). Publicly available exploit code exists (a public GitHub issue), and while CVSS 4.0 scores it 6.9 with E:P, our independent CVSS:3.1 assessment rates it as a low-severity confidentiality-only issue (C:L, no integrity or availability impact); there is no CISA KEV entry and no vendor-released patch identified at the time of analysis.
Authorization bypass (CWE-639, IDOR) in gedelumbung HospitalManagement lets an authenticated user of the admin application read patient-report records belonging to other users by tampering with the id_param argument passed to the detail function in application/modules/admin/controllers/laporan_data_pasien.php. The flaw is remote and needs no user interaction, but the attacker must first hold a valid admin session, and impact is limited to read-only disclosure of patient report data (no integrity or availability effect); our independent assessment rates this CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, broadly consistent with the published CVSS 4.0 base score of 5.1 (Medium). Publicly available exploit code exists (the vendor GitHub issue thread serves as the proof of concept), but there is no confirmed active exploitation (CISA KEV). The project is unversioned, the vendor was notified via an issue report and has not responded, so no fixed release is identified at time of analysis.
Missing per-ticket authorization in Zammad's GitHub and GitLab issue-tracker integration endpoints prior to 7.0.2 lets any authenticated agent - including one with no tickets assigned - enumerate ticket IDs and read the titles, statuses, labels, and URLs of external GitHub/GitLab issues linked to tickets they are not permitted to see. The flaw carries CVSS 5.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a low-confidentiality-impact disclosure confined to authenticated internal users, and yields nothing on instances where the GitHub/GitLab integration is not configured or no tickets carry linked issues. No public exploit code or active exploitation has been identified at time of analysis; the vendor shipped Zammad 7.0.2 as the fix.
Authorization bypass in GitHub Enterprise Server allows any authenticated instance user to read the raw diff or patch of pull requests in private repositories they should not be able to access. The flaw (CWE-639) stems from raw diff/patch access tokens being scoped to a repository name and pull request number rather than a globally unique repository identifier, so an attacker who creates their own repository and pull request matching a target's name and number can reuse a token minted for their own repository to retrieve the private pull request contents. Exploitation requires a valid account on the instance, the ability to create repositories and pull requests, and knowledge of the target repository name and a valid PR number, which is why the vendor's CVSS 4.0 rating is 6.0 with AT:P and the impact is limited to confidentiality (no write or availability effect); no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. All GHES versions prior to 3.22 are affected, with fixes in 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6.
Denial of service in GitHub Enterprise Server allows unauthenticated remote attackers to render an instance fully unresponsive by submitting a crafted form-encoded HTTP POST request containing deeply nested parameters, triggering uncontrolled recursive parsing that exhausts both CPU and the pool of request-handling worker processes. Because parameter parsing occurs before routing and authentication checks, every POST endpoint on the instance serves as a viable attack surface, requiring no foothold or prior knowledge of application structure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 E:U modifier confirms no known active exploitation at the time of scoring. GitHub has released patches across four supported release trains.
Missing authorization in GitHub Enterprise Server's delegated bypass endpoint exposes private repository metadata to any authenticated user with write access to a single repository on the same instance. The endpoint resolves rule suites from attacker-supplied encoded identifiers without verifying that the caller holds read permission on the target repository; because these identifiers are sequential, an attacker can enumerate them to harvest private repository names, owners, branch names, commit SHAs, commit messages, and pushing actors across the entire GHES instance. No public exploit identified at time of analysis; the issue was responsibly disclosed via the GitHub Bug Bounty program and vendor-released patches are available across all active support branches.
GitHub Enterprise Server (all versions prior to 3.22) is vulnerable to authenticated denial of service via unbounded YAML parsing depth in release notes configuration files. An authenticated user with repository access can craft a release notes configuration file containing arbitrarily deeply nested YAML structures; when release note generation is triggered, the YAML parser processes the nesting without any depth limit, causing excessive CPU and memory consumption that can render the entire GHES instance unresponsive. No public exploit has been identified at time of analysis, and this was responsibly disclosed through the GitHub Bug Bounty program.
Incorrect authorization in GitHub Enterprise Server allows an attacker who has obtained a victim's user-to-server token - issued by a GitHub App installation - to perform write operations on any public repository, regardless of whether that installation was explicitly granted access to the target repository. Affected installations span all GHES versions prior to 3.22, with fixes backported to six supported release trains. The CVSS 4.0 score is 5.3 (medium); no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stored cross-site scripting in GitHub Enterprise Server's Q&A Discussion feature allows an authenticated attacker to execute arbitrary JavaScript in any visiting user's browser by embedding a crafted payload into a Discussion title. The AnsweredQuestionStructuredDataComponent unsafely injects user-controlled titles into a server-rendered <script type="application/ld+json"> block, enabling script-context breakout; the attacker then leverages JSONP callback support in the GHES REST API to load arbitrary JavaScript and bypass the Content Security Policy entirely. No public exploit or CISA KEV listing exists at time of analysis, but the CSP bypass mechanism substantially elevates practical impact beyond typical stored XSS, enabling full session hijacking of any user who views the malicious Discussion.
Unauthorized source code disclosure in GitHub Enterprise Server exposes private repository contents to any authenticated user on the instance, regardless of their actual repository permissions. The Copilot pull request description diff summary endpoint accepted cross-repository comparison ranges and rendered the resulting diff without verifying the requesting user held read access to the target repository - a missing authorization flaw (CWE-862) allowing lateral access to arbitrary private repositories. No active exploitation has been confirmed (not in CISA KEV), the issue was responsibly disclosed via GitHub's Bug Bounty program, and patches are available across four release branches.
OAuth scope concealment in GitHub Enterprise Server allows an attacker to obtain unauthorized control over an organization's GitHub Actions runner management by exploiting a missing scope disclosure on the authorization consent screen. The `manage_runners:org` OAuth scope, which governs CI/CD runner infrastructure, is never shown to the victim during the standard OAuth authorization flow, enabling a maliciously crafted OAuth application to acquire it without informed user consent. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 4.8 and mandatory user interaction (UI:A) correctly reflect the social-engineering dependency that constrains real-world exploitation.
Reflected HTML injection in GitHub Enterprise Server Management Console login page allows credential theft when administrators click crafted links. The /setup/unlock endpoint reflects the redirect_to query parameter into an HTML attribute without sanitization, enabling attackers to inject malicious form elements that capture credentials. Affects versions 3.19.1-3.19.5 and 3.20.0-3.20.1; fixed in 3.19.6 and 3.20.2. Exploitation requires user interaction (administrator clicking a link), limiting real-world impact despite network-accessible attack surface.
Denial of service in GitHub Enterprise Server allows unauthenticated remote attackers to disrupt service by sending deeply nested JSON payloads to an unprotected API endpoint, causing excessive CPU and memory consumption. Affected versions prior to 3.21 (specifically 3.16.0-3.20.1) lack request size and depth validation. Vendor-released patches available for all affected branches: 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.
GitHub Enterprise Server versions prior to 3.21 contain an authentication bypass vulnerability that allows unauthenticated attackers to create local user accounts and establish sessions without validation by the configured external identity provider. The vulnerability affects instances with external authentication enabled, permitting account creation via the signup endpoint with default base permissions. Attack requires only network access and affects all affected versions across the 3.16-3.20 branch.
Private repository name disclosure in GitHub Enterprise Server allows any authenticated user to enumerate the names of private repositories by their numeric ID via a missing authorization check in the mobile upload policy API endpoint. Validation error responses included full repository names even when the requesting user lacked access to those repositories. No public exploit has been identified, EPSS is 0.05% (15th percentile), SSVC rates exploitation as none, and this was responsibly disclosed through the GitHub Bug Bounty program - indicators that real-world risk is low but the confidentiality impact is meaningful in environments with sensitive project naming conventions.
Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.
xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the un...
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code.
GitHub Enterprise Server allows authenticated users with limited personal access tokens to access private and internal repository data through the search API if they already have some level of access to those repositories via organization membership or collaborator status. This authorization bypass affects versions prior to 3.20 and enables information disclosure despite the tokens lacking the necessary repository scope permissions. No patch is currently available for this MEDIUM severity vulnerability.
DOM-based XSS in GitHub Enterprise Server prior to version 3.20 allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting malicious HTML through task list content in issues and pull requests. The vulnerability stems from improper input neutralization in the task list rendering logic, which fails to re-encode user-supplied content before display. An attacker with repository access could exploit this to steal session tokens or perform actions on behalf of other users.
GitHub Enterprise Server allows users with read-only repository access and project write permissions to modify issue and pull request metadata by exploiting insufficient authorization checks when updating project items. An attacker with these limited permissions can alter sensitive metadata without the required repository write access, potentially disrupting workflow management and data integrity. This vulnerability affects multiple versions and currently has no publicly available patch.
Authenticated users in OpenEMR through version 8.0.0 can access and modify eye exam records belonging to other patients by manipulating form IDs, bypassing patient context validation. This allows disclosure or alteration of sensitive medical data across the patient database, and public exploit code exists for this vulnerability. A patch is available on the main branch of the OpenEMR repository.
LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions workflow is vulnerable to JavaScript injection.
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaScript in users' browsers when developers pass unsanitized input from URL parameters or other sources to the repo prop. The vulnerability stems from unsafe use of dangerouslySetInnerHTML without input validation, and public exploit code exists. Upgrading to version 1.0.1 or later eliminates the risk by removing dangerouslySetInnerHTML in favor of safe JSX data binding.
PJSIP versions 2.16 and below contain a heap buffer overflow in the H.264 video unpacketizer that fails to properly validate NAL unit size fields in malformed SRTP packets, allowing remote attackers to trigger memory corruption on systems receiving H.264 video streams. The vulnerability has a CVSS score of 5.3 and enables information disclosure through heap memory access. A patch is available for affected deployments.
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point.
Trivy Action versions 0.31.0 through 0.33.1 allow remote code execution on GitHub Actions runners due to insufficient input sanitization when constructing shell environment variable exports. An attacker with repository access can inject shell metacharacters through action inputs to achieve arbitrary command execution in the runner context. The vulnerability requires high privileges to exploit and is addressed in version 0.34.0.
Cross-site scripting in Indico prior to version 3.3.10 allows authenticated users to inject malicious scripts through material file uploads, potentially compromising other users' sessions or stealing sensitive data. The vulnerability affects Indico deployments using Flask-Multipass authentication and requires both user interaction and authenticated access to exploit. A patch is available, and administrators should upgrade to version 3.3.10 and update webserver configurations to enforce strict Content Security Policy for file downloads.
GitHub Enterprise Server versions before 3.20 contain an authorization bypass in the repository migration upload endpoint that permits authenticated attackers to inject malicious content into other users' migration exports. An attacker can overwrite a victim's migration archive and cause them to download compromised repository data during restoration or automated imports. No patch is currently available, affecting all versions prior to 3.20.
Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler.
Harden-Runner versions prior to 2.14.2 fail to log outbound network connections made through sendto, sendmsg, and sendmmsg socket calls when audit mode is enabled, allowing attackers to exfiltrate data from GitHub Actions runners without detection. This integrity bypass affects users relying on Harden-Runner's egress policy auditing for security monitoring. A patch is available in version 2.14.2 and later.
Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK.
Arithmetic overflow in Soroban SDK versions up to 25.0.2 allows contracts using user-controlled range bounds in Bytes::slice, Vec::slice, or Prng::gen_range methods to operate on incorrect data ranges or generate unintended random numbers, potentially corrupting contract state. Developers who do not enable overflow-checks in their Rust configuration are vulnerable to this silent data corruption. A patch is available and should be applied immediately to affected Soroban contracts.
Bun versions prior to 1.3.5 allow attackers to bypass the trusted dependencies allowlist by creating non-npm packages with names matching legitimate packages, enabling potential code execution through dependency confusion attacks. This local vulnerability affects systems using Bun's package management where an attacker can craft malicious packages with identical names to trusted dependencies. No patch is currently available for affected Node.js and GitHub integrations.
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package directory by exploiting incomplete path normalization that fails to block backslash-based traversal sequences. Public exploit code exists for this vulnerability, which affects Windows developers and CI/CD pipelines (GitHub Actions, Azure DevOps) and could result in overwriting sensitive configuration files like .npmrc or build configurations. A patch is available in pnpm version 10.28.1 and later.
The Golang sigstore framework versions 1.10.3 and below fail to validate cache directory paths in the legacy TUF client, allowing a malicious TUF repository to overwrite arbitrary files on disk within the calling process's permission scope. This impacts direct users of the TUF client in sigstore/sigstore and older Cosign versions, though public Sigstore deployments are protected by metadata validation from trusted collaborators. No patch is currently available for this medium-severity path traversal vulnerability.
ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under speci...
Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service, allowing attackers to execute arbitrary OS commands.
Improper URI path normalization in Vert.x Web's static file handler allows remote attackers to manipulate the cache and deny access to static files through specially crafted request URIs containing encoded path traversal sequences. An unauthenticated attacker can exploit this vulnerability over the network with no user interaction to cause denial of service by returning HTTP 404 responses for normally accessible files. Public exploit code exists and patches are available.
Account pre-hijacking in the Prowler API (5.4.0 up to but not including 5.35.0) lets an unauthenticated remote attacker gain persistent control of a user account that has not yet registered, by self-registering the victim's email address before the real owner ever signs up or links single sign-on. Because social account linking in ProwlerSocialAccountAdapter.pre_social_login() matches a Google or GitHub login to any existing local account with the same email address without requiring the address to be verified by the provider or on the local account, the genuine owner's later social sign-in is silently connected to the attacker's pre-created account, and the attacker's original password remains valid, exposing cloud provider credentials, scan findings and tenant memberships held in that account. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though exploitation requires only open self-registration plus a victim who later authenticates through Google or GitHub (a race condition that closes once the legitimate owner has an account). The source assigns CVSS 4.0 7.6 (HIGH); our independent assessment scores it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Server-side request forgery in GitHub Enterprise Server 3.20, 3.21, and 3.22 lets an authenticated repository contributor with push permission cause the appliance to issue requests to attacker-controlled internal hosts, which can be chained to remote code execution on the appliance. The flaw sits in the secret scanning validator for GCP service account credentials, which trusts the token endpoint embedded in a committed credential and sends a request to it without restricting the destination, and it additionally requires GitHub Advanced Security with secret scanning validity checks enabled, a non-default configuration. No public exploit identified at time of analysis; vendor-released patches are 3.20.9, 3.21.7, and 3.22.2, and the issue was reported through the GitHub Bug Bounty program.
Stored cross-site scripting in GitHub Enterprise Server (3.17 through 3.22 series) allows an authenticated user to inject arbitrary HTML attributes through crafted Markdown that survives initial sanitization but is then re-interpreted by the rendering pipeline's quote-character rewriting step, letting the payload chain same-origin JavaScript gadgets to bypass Content Security Policy and seize control of the page DOM in a victim's browser. When a second user views the rendered content, the attacker can read content visible to that victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes, with the payload potentially propagating into any repository or organization where the victim holds write access. Exploitation requires an authenticated account and victim interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, vendor score 7.4), no public exploit code has been identified at time of analysis, and vendor-released patches exist in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
Server-side request forgery in the GitHub Enterprise Server notebook viewer allows a remote attacker to direct requests to internal services listening on non-standard ports of the same appliance, because the viewer validated a user-supplied URL's scheme and host but not its port. Response bodies are not returned, but response timing acts as an oracle that can be used to extract instance secrets character by character; an extracted secret can then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. All GitHub Enterprise Server versions 3.17 through 3.22 are affected; exploitation requires network access to the instance and is unauthenticated only when private mode is disabled, otherwise any authenticated user suffices, and no public exploit has been identified at time of analysis. Note that the independent assessment rates this as high difficulty (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), since full impact depends on a multi-step timing-oracle extraction succeeding and a usable internal service being reachable for the follow-on RCE.
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAuth tokens and client secrets, webhook secrets, and Gitea/Bitbucket access tokens, refresh tokens, and app passwords - to authenticated organization members who were never granted access to those providers. The protected tRPC procedures github.one, gitlab.one, gitea.one, and bitbucket.one return full provider rows without applying getAccessibleGitProviderIds or an organization check, and application.one returns the same secrets as nested relations from findApplicationById even when hasGitProviderAccess is false. Exploitation requires an authenticated Dokploy account (PR:L) holding application read access or knowledge of a provider identifier, and the practical impact is confidentiality: a restricted member can use the leaked credentials to read private repositories or manipulate external CI/CD and webhook workflows. No public exploit code has been identified at time of analysis.
GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.
Remote code execution via a time-of-check time-of-use race condition in GitHub Enterprise Server affects all versions prior to 3.22. An authenticated user holding repository write access can trigger the vulnerability by issuing precisely timed concurrent upload requests, exploiting the window between a security check and the file operation it guards. No public exploit code or CISA KEV listing has been identified; the issue was responsibly disclosed through GitHub's Bug Bounty program and patched across five active release branches.
SSRF in GitHub Enterprise Server (all versions prior to 3.22) allows unauthenticated network attackers to force the Manage API to issue gateway-to-agent requests toward an attacker-controlled host, and - by intercepting those outbound requests - capture a weakly-scoped HMAC token replayable against privileged management agent endpoints. The flaw arises from an unauthenticated cluster-configuration parsing endpoint combined with an HMAC scheme that signs only a timestamp, leaving request paths and bodies unsigned and the captured token replayable with arbitrary content. Vendor-released patches are available across five supported branches (3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbitrary code execution by any authenticated user holding async query access. The vulnerable component is the SQL query validation layer in the Flint extension, which fails to prevent crafted payloads from reaching and executing on Spark worker nodes. No public exploit code has been identified at time of analysis, but the network-reachable RCE primitive, low complexity, and low privilege requirement collectively make this a high-priority remediation target; vendor patches are available in OpenSearch 3.7.0 and 2.19.6.
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. Patch is confirmed available per Amazon's security bulletin AWS-2026-079; no public exploit code has been identified at time of analysis.
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remote user to read, modify, or delete arbitrary index data by supplying crafted inline monitor requests with attacker-controlled data source and input index parameters. The flaw bypasses index-level permission enforcement, making it a meaningful privilege escalation risk in multi-tenant or shared OpenSearch deployments. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file and directory deletion in GitHub Enterprise Server allows any network-reachable attacker to recursively destroy critical instance data - including Git LFS objects, release assets, issue attachments, and user avatars - by injecting a path traversal sequence into the X-GitHub-Request-Id HTTP request header. The vulnerability stems from using this header value unsanitized as a filesystem path component for an upload buffer directory; a deferred cleanup routine then recursively deletes whatever directory the traversal resolves to, including the entire user storage root. No public exploit has been identified at time of analysis and the CVE is not in the CISA KEV catalog, but the near-zero exploitation bar - no authentication, no user interaction, effective even with private mode enabled - makes this a critical priority for any organization running on-premises GitHub Enterprise Server.
Arbitrary file write in GitHub Enterprise Server (all releases before 3.22) lets an attacker who already has code execution inside the Dependabot updater container escape the intended dependency-file directory via path traversal and symlink manipulation, planting attacker-controlled files anywhere in a repository - including GitHub Actions workflows under .github/workflows/. Because path validation checked the declared rather than the effective (symlink-resolved) path, an injected workflow can run with the repository's Actions secrets when the repo uses pull_request_target or auto-merge. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 4.0 base score is 8.6 (High).
Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issuing crafted requests to internal services, reachable through an upload endpoint that fails to validate input. By injecting path-traversal content into request parameters, an attacker can redirect internal API calls to reach back-end services and harvest sensitive credentials. No public exploit identified at time of analysis; the issue was reported through the GitHub Bug Bounty program and carries a CVSS 4.0 base score of 9.2 (Critical), though the vector flags high attack complexity and an extra attack requirement that temper real-world ease of exploitation.
Server-Side Request Forgery in GitHub Enterprise Server lets an attacker coerce the appliance into issuing HTTP requests to internal services through the security advisories package-lookup feature, then use response-timing differences as an oracle to infer sensitive environment variables such as signing secrets and private keys. All versions prior to 3.21.1 are affected, and exploitation is unauthenticated on instances not running in private mode (GitHub Packages must be enabled), or available to any authenticated user otherwise. No public exploit identified at time of analysis; the issue was reported through the GitHub Bug Bounty program and carries a CVSS 4.0 base score of 7.0.
Server-side request forgery in GitHub Enterprise Server's notebook viewer enables remote unauthenticated attackers to access internal services and systems through URL parser confusion. The vulnerability exploits discrepancies between validation and request execution parsers, allowing crafted URLs to bypass hostname checks and target unintended internal hosts. All versions prior to 3.21 are affected, with patches available across supported release branches (3.16.18, 3.17.15, 3.18.9, 3.19.6, 3.20.2). CVSS 7.9 reflects high impact to subsequent system confidentiality, integrity, and availability. No active exploitation confirmed (not in CISA KEV); reported through GitHub Bug Bounty program.
Information disclosure via server-side request forgery in GitHub Enterprise Server (all versions prior to 3.21) lets an unauthenticated attacker read sensitive environment variables from the appliance. The notebook rendering service follows HTTP redirects without revalidating the destination host, so an attacker who chains the instance's open-redirect endpoint can reach internal services and, using regex filter queries against an internal API combined with response-timing measurement, exfiltrate secret values one character at a time. No public exploit is identified at time of analysis and EPSS is very low (0.05%), but SSVC rates the technical impact as total.
Improper authorization in GitHub Enterprise Server (GHES) lets an authenticated attacker abuse scoped user-to-server (ghu_) tokens to reach private repositories outside their intended GitHub App installation scope, including write access. The root cause is an authorization fallback that treated a revoked or deleted installation as a global installation context; chained with token-revocation timing and SSH push attribution, an attacker can obtain and reuse a victim-scoped token. It affects all GHES releases prior to 3.21 and was reported through the GitHub Bug Bounty program, with no public exploit identified at time of analysis.
OS command injection in GitHub Enterprise Server (all releases prior to 3.21) lets an authenticated Management Console administrator run arbitrary shell commands on the underlying appliance by embedding shell metacharacters in proxy configuration fields such as http_proxy. The flaw was reported through the GitHub Bug Bounty program and there is no public exploit identified at time of analysis; EPSS is negligible (0.01%, 3rd percentile) and CISA SSVC rates exploitation as none. Because it requires high-privilege console access, it is primarily a privilege-boundary escape from Management Console admin to full OS-level control rather than a remotely reachable pre-auth issue.
Account takeover in GitHub Enterprise Server (all versions prior to 3.21) is possible through an OAuth redirect URI validation bypass caused by a flawed regular expression (CWE-185). An attacker who knows a first-party OAuth application's registered callback URL can craft a malicious authorization link that leaks the victim's OAuth authorization code to an attacker-controlled domain, granting access to the victim's account with the scopes of that application. Reported via the GitHub Bug Bounty program; there is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records exploitation status as none.
Remote code execution in GitHub Enterprise Server allows authenticated users with repository push access to execute arbitrary code via unsanitized push option values that bypass internal header validation. An attacker can inject malicious metadata fields by exploiting insufficient input sanitization in the git push operation handler. This high-severity vulnerability affects GitHub Enterprise Server versions prior to 3.14.24, 3.15.19, 3.16.15, 3.17.12, 3.18.6, and 3.19.3, with no patch currently available for all affected installations.
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by exploiting insufficient validation in the OAuth callback handler, enabling them to redirect repository access and create code records in arbitrary projects. Public exploit code exists for this vulnerability, and GitHub and OneUptime users remain at risk until patches are applied, as no fixes are currently available for the affected GitHub integration.
Arbitrary code execution in GitHub Copilot CLI versions <=0.0.422 allows attackers to bypass the agent's shell command safety classifier using bash parameter expansion operators (${var@P}, ${var=value}, ${!var}, and nested $(cmd)/<(cmd)). Attackers influencing agent inputs via prompt injection through repository files, MCP server responses, or user instructions can execute hidden commands disguised as read-only operations on the user's workstation. A detailed proof-of-concept is published in the GHSA advisory; EPSS is low (0.10%, 28th percentile) and the issue is not in CISA KEV, so no public exploit identified at time of analysis beyond the vendor-published PoC.
Improper authorization in Google Cloud Build GitHub Trigger allowing unauthenticated build execution. EPSS 0.19%.
Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrite the entire infrastructure configuration. PoC available.
Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables malicious PRs to execute code in the context of the base repository. PoC and patch available.
Arbitrary command execution in WPGraphQL's GitHub Actions workflow allows attackers with pull request creation privileges to inject shell commands through unvalidated pull request body content, potentially compromising the build environment and repository integrity. The vulnerability affects WPGraphQL versions prior to 2.9.1 and requires low privileges and user interaction to exploit. No patch is currently available for affected deployments.
Incorrect computation in CIRCL cryptographic library's CombinedMult function for secp384r1 (P-384) curve. Produces wrong elliptic curve multiplication results for specific inputs, potentially breaking ECDSA signature verification.
Arbitrary command execution in OpenClaw versions 2026.1.8 through 2026.2.13 allows attackers to execute shell commands when developers or CI systems run the update-clawtributors.ts maintenance script on repositories containing malicious commit metadata. The vulnerability stems from unsanitized interpolation of git author emails into shell commands via execSync, exploitable only by those with access to the development environment or source repository. Version 2026.2.14 patches the issue.
GitHub Enterprise Server allows authenticated webhook administrators to bypass network restrictions through Server-Side Request Forgery, enabling access to internal services, job queues, and sensitive endpoints on loopback addresses. This affects all versions prior to 3.20 and requires valid credentials with webhook configuration privileges. No patch is currently available, and exploitation could lead to unauthorized data access or disruption of background job processing.
URL redirection vulnerability in GitHub Enterprise Server allows attacker-controlled redirects through crafted URLs, potentially enabling credential theft via phishing.
Authenticated users can exploit a race condition in GitHub Copilot and Visual Studio Code to execute arbitrary code remotely by manipulating file state between verification and use. This vulnerability affects users with network access to these development tools and requires user interaction to trigger. No patch is currently available to address this high-severity flaw.
GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers to bypass security features over the network through improper neutralization of special command elements. The vulnerability requires user interaction to exploit and could enable attackers to execute arbitrary commands with high impact on confidentiality, integrity, and availability. No patch is currently available for this issue.
GitHub Copilot is vulnerable to command injection attacks that enable remote code execution without requiring authentication or user interaction beyond a click. An attacker can exploit this network-accessible vulnerability to execute arbitrary commands on affected systems. No patch is currently available for this high-severity vulnerability.
GitHub Copilot and Visual Studio 2022 contain a command injection vulnerability that allows authenticated users to execute arbitrary commands through improper sanitization of special elements. An attacker with valid credentials can leverage user interaction to escalate privileges and gain elevated access across the network. No patch is currently available for this vulnerability.
Remote code execution in GitHub Copilot and Visual Studio 2022 via command injection allows unauthenticated attackers to execute arbitrary code over the network with user interaction. The vulnerability stems from improper sanitization of special elements in commands, enabling attackers to break out of intended command contexts and inject malicious payloads. No patch is currently available for this high-severity issue affecting both development environments.
Command injection in GitHub Super-linter versions 6.0.0 through 8.3.0 allows attackers to execute arbitrary commands in workflow runner contexts by submitting pull requests with maliciously crafted filenames containing shell command substitution syntax. An attacker exploiting this vulnerability can access sensitive workflow credentials, including GITHUB_TOKEN, depending on permission configurations. The vulnerability affects Super-linter when used as a GitHub Action and has no available patch at this time.
PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enabling attackers to conduct login CSRF attacks against GitHub and Google login flows. An attacker can pre-authenticate a victim's session and trick them into logging into the attacker's account, causing the victim's data and academic progress to be stored on the attacker's account instead. Public exploit code exists for this vulnerability, and a patch is available.
Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. CVSS 10.0, PoC available.
github-kanban-mcp-server has a command injection in execAsync (EPSS 1.0%) enabling remote code execution on developer machines using the GitHub Kanban MCP integration.
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers to write arbitrary files to the server through malicious tar archives, bypassing incomplete path sanitization. Public exploit code exists for this vulnerability. The issue stems from improper validation of absolute paths in tar file entries, enabling potential code execution or service disruption on affected systems.
Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling arbitrary code execution with repository write permissions from fork PRs. PoC available, patch available.
ECDSA adaptor pre-signature verification in UltrafastSecp256k1 before 4.2.0 accepts forged adaptor pre-signatures whose r value is not cryptographically bound to the adaptor point T, allowing a malicious signing counterparty to produce a pre-signature that passes ecdsa_adaptor_verify even though it is not genuinely adaptable. This is an integrity-only cryptographic soundness flaw (CVSS 3.1 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) affecting deployments that use the library's ECDSA adaptor-signature path, such as atomic swaps, discreet log contracts, or payment channels. No public exploit code was identified at time of analysis, and it is fully fixed in 4.2.0.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows remote, unauthenticated attackers to manipulate database queries through the ID parameter of admin/delete1.php, a script the description treats as an unauthenticated action endpoint despite its location under the admin/ directory. Successful exploitation grants low-level confidentiality, integrity, and availability impact on the application's database, and publicly available exploit code exists, raising the likelihood of opportunistic scanning and abuse. The project is distributed via rolling releases with no versioned builds, the maintainer has not responded to the early issue report, so no vendor-released patch is available and every running instance should be considered affected; the practical risk is narrowed by the product's very low deployment footprint and the need for the endpoint to be reachable over the network.
A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.
SQL injection in OS4ED openSIS-Classic up to and including 9.3 lets an authenticated, highly privileged user manipulate the argument values reaching the db_properties function in functions/DatabaseInc.php, allowing crafted input to alter or extract database contents through the Save Data Handler code path. The flaw is network-reachable and needs no user interaction, but the CVSS vector requires PR:H, so anonymous or low-privilege accounts cannot reach it directly; publicly available exploit code exists via the project's public issue report. The vendor was notified through that issue and has not responded, so no vendor-released patch is identified at time of analysis, and the overall real-world risk is assessed as low despite the SQL injection class.
Authenticated SQL injection in OS4ED openSIS-Classic 9.3 and earlier allows a low-privileged user to manipulate the LO_sort argument in the Student List Search endpoint, which reaches the DBQuery function and can expose or alter database contents. The issue is remotely exploitable, requires a valid session (CVSS PR:L), and publicly available exploit code exists; there is no confirmed CISA KEV active exploitation. The affected release is a niche open-source PHP student information system, so real-world priority is modest despite the SQL injection class.
SQL injection in OS4ED openSIS-Classic (up to and including version 9.3) lets an authenticated low-privileged user - a staff or teacher account is sufficient - manipulate the 'cust' argument handled by functions/CustomFieldsFnc.php in the Student Search component and read or partially modify the backend database, including student records. Publicly available exploit code exists, and the vendor was notified through a public GitHub issue but has not responded, so no vendor-released patch is identified at time of analysis. This is a high-CVSS-but-moderate-real-risk issue: the requirement for a valid authenticated session and the product's education-sector, small-scale deployments meaningfully narrow the exposed population.
SQL injection in OS4ED openSIS-Classic up to and including version 9.3 lets an authenticated attacker with any valid low-privileged account run arbitrary SQL against the backend database by manipulating the Tables argument passed to DBQuery_assignment in modules/grades/Assignments.php. The endpoint is reachable over the network with no user interaction and no special configuration, and publicly available exploit code exists; however, exploitation requires a valid session (CVSS vector PR:L, and the assessed vector confirms PR:L), so anonymous internet-wide attacks are not possible, and no confirmed active exploitation (CISA KEV) has been reported. Real-world priority is therefore low-to-moderate, driven mainly by the authentication prerequisite and openSIS-Classic's limited deployment footprint.
Cross-site scripting in the Guest Book component of gedelumbung HospitalManagement (PHP) allows remote, unauthenticated attackers to inject script payloads through the nama, email, and pesan fields handled by the kirim function in application/modules/web/controllers/buku_tamu.php, with the payload executing when a victim loads the affected guest-book page (publicly available exploit code exists; no confirmed active exploitation). The project ships as a rolling release, so no discrete affected or fixed version numbers exist - any deployment at or before commit c2d45543789a3887067d3915f69d44cfc2cf76a8 is presumed vulnerable. Impact is limited: the maintainer has not responded to the issue report and no vendor patch is available, but the required victim interaction, the low CVSS 2.1 base score, and a niche installation base keep this a low-priority finding.
Improper authorization in the gedelumbung HospitalManagement configuration handler lets an authenticated high-privilege user write arbitrary configuration values through the sistem.php 'simpan' action without the application enforcing an adequate access-control check. Only deployments running the current rolling-release codebase are affected, since the project publishes no versioned releases and the CPE entry carries a wildcard version; the practical exposure is limited to Low confidentiality, integrity, and availability impact on configuration data rather than full host or data compromise. Publicly available exploit code exists via the project's GitHub issue tracker (issue #12), but there is no indication of confirmed active exploitation, and the EPSS-style risk signal remains modest; the attacker must already hold an administrative session (CVSS PR:H, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), which keeps real-world risk low despite the nominally elevated severity.
Information disclosure in gedelumbung HospitalManagement lets unauthenticated remote attackers obtain sensitive diagnostic output generated through the error_reporting handling in index.php, because PHP error text is emitted into HTTP responses. Exploitation requires only that the deployed instance runs with PHP error reporting/display enabled (the project's default or a common production misconfiguration) and that the attacker can remotely induce an error condition; no authentication or user interaction is needed (PR:N/UI:N). Publicly available exploit code exists (a public GitHub issue), and while CVSS 4.0 scores it 6.9 with E:P, our independent CVSS:3.1 assessment rates it as a low-severity confidentiality-only issue (C:L, no integrity or availability impact); there is no CISA KEV entry and no vendor-released patch identified at the time of analysis.
Authorization bypass (CWE-639, IDOR) in gedelumbung HospitalManagement lets an authenticated user of the admin application read patient-report records belonging to other users by tampering with the id_param argument passed to the detail function in application/modules/admin/controllers/laporan_data_pasien.php. The flaw is remote and needs no user interaction, but the attacker must first hold a valid admin session, and impact is limited to read-only disclosure of patient report data (no integrity or availability effect); our independent assessment rates this CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, broadly consistent with the published CVSS 4.0 base score of 5.1 (Medium). Publicly available exploit code exists (the vendor GitHub issue thread serves as the proof of concept), but there is no confirmed active exploitation (CISA KEV). The project is unversioned, the vendor was notified via an issue report and has not responded, so no fixed release is identified at time of analysis.
Missing per-ticket authorization in Zammad's GitHub and GitLab issue-tracker integration endpoints prior to 7.0.2 lets any authenticated agent - including one with no tickets assigned - enumerate ticket IDs and read the titles, statuses, labels, and URLs of external GitHub/GitLab issues linked to tickets they are not permitted to see. The flaw carries CVSS 5.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a low-confidentiality-impact disclosure confined to authenticated internal users, and yields nothing on instances where the GitHub/GitLab integration is not configured or no tickets carry linked issues. No public exploit code or active exploitation has been identified at time of analysis; the vendor shipped Zammad 7.0.2 as the fix.
Authorization bypass in GitHub Enterprise Server allows any authenticated instance user to read the raw diff or patch of pull requests in private repositories they should not be able to access. The flaw (CWE-639) stems from raw diff/patch access tokens being scoped to a repository name and pull request number rather than a globally unique repository identifier, so an attacker who creates their own repository and pull request matching a target's name and number can reuse a token minted for their own repository to retrieve the private pull request contents. Exploitation requires a valid account on the instance, the ability to create repositories and pull requests, and knowledge of the target repository name and a valid PR number, which is why the vendor's CVSS 4.0 rating is 6.0 with AT:P and the impact is limited to confidentiality (no write or availability effect); no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. All GHES versions prior to 3.22 are affected, with fixes in 3.17.21, 3.18.15, 3.19.12, 3.20.8, and 3.21.6.
Denial of service in GitHub Enterprise Server allows unauthenticated remote attackers to render an instance fully unresponsive by submitting a crafted form-encoded HTTP POST request containing deeply nested parameters, triggering uncontrolled recursive parsing that exhausts both CPU and the pool of request-handling worker processes. Because parameter parsing occurs before routing and authentication checks, every POST endpoint on the instance serves as a viable attack surface, requiring no foothold or prior knowledge of application structure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 E:U modifier confirms no known active exploitation at the time of scoring. GitHub has released patches across four supported release trains.
Missing authorization in GitHub Enterprise Server's delegated bypass endpoint exposes private repository metadata to any authenticated user with write access to a single repository on the same instance. The endpoint resolves rule suites from attacker-supplied encoded identifiers without verifying that the caller holds read permission on the target repository; because these identifiers are sequential, an attacker can enumerate them to harvest private repository names, owners, branch names, commit SHAs, commit messages, and pushing actors across the entire GHES instance. No public exploit identified at time of analysis; the issue was responsibly disclosed via the GitHub Bug Bounty program and vendor-released patches are available across all active support branches.
GitHub Enterprise Server (all versions prior to 3.22) is vulnerable to authenticated denial of service via unbounded YAML parsing depth in release notes configuration files. An authenticated user with repository access can craft a release notes configuration file containing arbitrarily deeply nested YAML structures; when release note generation is triggered, the YAML parser processes the nesting without any depth limit, causing excessive CPU and memory consumption that can render the entire GHES instance unresponsive. No public exploit has been identified at time of analysis, and this was responsibly disclosed through the GitHub Bug Bounty program.
Incorrect authorization in GitHub Enterprise Server allows an attacker who has obtained a victim's user-to-server token - issued by a GitHub App installation - to perform write operations on any public repository, regardless of whether that installation was explicitly granted access to the target repository. Affected installations span all GHES versions prior to 3.22, with fixes backported to six supported release trains. The CVSS 4.0 score is 5.3 (medium); no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stored cross-site scripting in GitHub Enterprise Server's Q&A Discussion feature allows an authenticated attacker to execute arbitrary JavaScript in any visiting user's browser by embedding a crafted payload into a Discussion title. The AnsweredQuestionStructuredDataComponent unsafely injects user-controlled titles into a server-rendered <script type="application/ld+json"> block, enabling script-context breakout; the attacker then leverages JSONP callback support in the GHES REST API to load arbitrary JavaScript and bypass the Content Security Policy entirely. No public exploit or CISA KEV listing exists at time of analysis, but the CSP bypass mechanism substantially elevates practical impact beyond typical stored XSS, enabling full session hijacking of any user who views the malicious Discussion.
Unauthorized source code disclosure in GitHub Enterprise Server exposes private repository contents to any authenticated user on the instance, regardless of their actual repository permissions. The Copilot pull request description diff summary endpoint accepted cross-repository comparison ranges and rendered the resulting diff without verifying the requesting user held read access to the target repository - a missing authorization flaw (CWE-862) allowing lateral access to arbitrary private repositories. No active exploitation has been confirmed (not in CISA KEV), the issue was responsibly disclosed via GitHub's Bug Bounty program, and patches are available across four release branches.
OAuth scope concealment in GitHub Enterprise Server allows an attacker to obtain unauthorized control over an organization's GitHub Actions runner management by exploiting a missing scope disclosure on the authorization consent screen. The `manage_runners:org` OAuth scope, which governs CI/CD runner infrastructure, is never shown to the victim during the standard OAuth authorization flow, enabling a maliciously crafted OAuth application to acquire it without informed user consent. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 4.8 and mandatory user interaction (UI:A) correctly reflect the social-engineering dependency that constrains real-world exploitation.
Reflected HTML injection in GitHub Enterprise Server Management Console login page allows credential theft when administrators click crafted links. The /setup/unlock endpoint reflects the redirect_to query parameter into an HTML attribute without sanitization, enabling attackers to inject malicious form elements that capture credentials. Affects versions 3.19.1-3.19.5 and 3.20.0-3.20.1; fixed in 3.19.6 and 3.20.2. Exploitation requires user interaction (administrator clicking a link), limiting real-world impact despite network-accessible attack surface.
Denial of service in GitHub Enterprise Server allows unauthenticated remote attackers to disrupt service by sending deeply nested JSON payloads to an unprotected API endpoint, causing excessive CPU and memory consumption. Affected versions prior to 3.21 (specifically 3.16.0-3.20.1) lack request size and depth validation. Vendor-released patches available for all affected branches: 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.
GitHub Enterprise Server versions prior to 3.21 contain an authentication bypass vulnerability that allows unauthenticated attackers to create local user accounts and establish sessions without validation by the configured external identity provider. The vulnerability affects instances with external authentication enabled, permitting account creation via the signup endpoint with default base permissions. Attack requires only network access and affects all affected versions across the 3.16-3.20 branch.
Private repository name disclosure in GitHub Enterprise Server allows any authenticated user to enumerate the names of private repositories by their numeric ID via a missing authorization check in the mobile upload policy API endpoint. Validation error responses included full repository names even when the requesting user lacked access to those repositories. No public exploit has been identified, EPSS is 0.05% (15th percentile), SSVC rates exploitation as none, and this was responsibly disclosed through the GitHub Bug Bounty program - indicators that real-world risk is low but the confidentiality impact is meaningful in environments with sensitive project naming conventions.
Authorization bypass in GitHub Enterprise Server allows a repository admin to hijack secret scanning push protection delegated bypass reviewer lists on repositories they do not administer. The server authorizes requests against the repository specified in the URL path but applies the configuration change to the repository identified by the attacker-controlled owner_id parameter in the request body - a classic IDOR pattern (CWE-639). Impact is constrained: an attacker can only assign existing trusted users within the instance as bypass reviewers, not introduce arbitrary external accounts. No public exploit exists and EPSS is 0.05% (14th percentile); patched releases are available for all supported GHES branches.
xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the un...
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code.
GitHub Enterprise Server allows authenticated users with limited personal access tokens to access private and internal repository data through the search API if they already have some level of access to those repositories via organization membership or collaborator status. This authorization bypass affects versions prior to 3.20 and enables information disclosure despite the tokens lacking the necessary repository scope permissions. No patch is currently available for this MEDIUM severity vulnerability.
DOM-based XSS in GitHub Enterprise Server prior to version 3.20 allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting malicious HTML through task list content in issues and pull requests. The vulnerability stems from improper input neutralization in the task list rendering logic, which fails to re-encode user-supplied content before display. An attacker with repository access could exploit this to steal session tokens or perform actions on behalf of other users.
GitHub Enterprise Server allows users with read-only repository access and project write permissions to modify issue and pull request metadata by exploiting insufficient authorization checks when updating project items. An attacker with these limited permissions can alter sensitive metadata without the required repository write access, potentially disrupting workflow management and data integrity. This vulnerability affects multiple versions and currently has no publicly available patch.
Authenticated users in OpenEMR through version 8.0.0 can access and modify eye exam records belonging to other patients by manipulating form IDs, bypassing patient context validation. This allows disclosure or alteration of sensitive medical data across the patient database, and public exploit code exists for this vulnerability. A patch is available on the main branch of the OpenEMR repository.
LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions workflow is vulnerable to JavaScript injection.
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaScript in users' browsers when developers pass unsanitized input from URL parameters or other sources to the repo prop. The vulnerability stems from unsafe use of dangerouslySetInnerHTML without input validation, and public exploit code exists. Upgrading to version 1.0.1 or later eliminates the risk by removing dangerouslySetInnerHTML in favor of safe JSX data binding.
PJSIP versions 2.16 and below contain a heap buffer overflow in the H.264 video unpacketizer that fails to properly validate NAL unit size fields in malformed SRTP packets, allowing remote attackers to trigger memory corruption on systems receiving H.264 video streams. The vulnerability has a CVSS score of 5.3 and enables information disclosure through heap memory access. A patch is available for affected deployments.
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point.
Trivy Action versions 0.31.0 through 0.33.1 allow remote code execution on GitHub Actions runners due to insufficient input sanitization when constructing shell environment variable exports. An attacker with repository access can inject shell metacharacters through action inputs to achieve arbitrary command execution in the runner context. The vulnerability requires high privileges to exploit and is addressed in version 0.34.0.
Cross-site scripting in Indico prior to version 3.3.10 allows authenticated users to inject malicious scripts through material file uploads, potentially compromising other users' sessions or stealing sensitive data. The vulnerability affects Indico deployments using Flask-Multipass authentication and requires both user interaction and authenticated access to exploit. A patch is available, and administrators should upgrade to version 3.3.10 and update webserver configurations to enforce strict Content Security Policy for file downloads.
GitHub Enterprise Server versions before 3.20 contain an authorization bypass in the repository migration upload endpoint that permits authenticated attackers to inject malicious content into other users' migration exports. An attacker can overwrite a victim's migration archive and cause them to download compromised repository data during restoration or automated imports. No patch is currently available, affecting all versions prior to 3.20.
Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler.
Harden-Runner versions prior to 2.14.2 fail to log outbound network connections made through sendto, sendmsg, and sendmmsg socket calls when audit mode is enabled, allowing attackers to exfiltrate data from GitHub Actions runners without detection. This integrity bypass affects users relying on Harden-Runner's egress policy auditing for security monitoring. A patch is available in version 2.14.2 and later.
Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK.
Arithmetic overflow in Soroban SDK versions up to 25.0.2 allows contracts using user-controlled range bounds in Bytes::slice, Vec::slice, or Prng::gen_range methods to operate on incorrect data ranges or generate unintended random numbers, potentially corrupting contract state. Developers who do not enable overflow-checks in their Rust configuration are vulnerable to this silent data corruption. A patch is available and should be applied immediately to affected Soroban contracts.
Bun versions prior to 1.3.5 allow attackers to bypass the trusted dependencies allowlist by creating non-npm packages with names matching legitimate packages, enabling potential code execution through dependency confusion attacks. This local vulnerability affects systems using Bun's package management where an attacker can craft malicious packages with identical names to trusted dependencies. No patch is currently available for affected Node.js and GitHub integrations.
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package directory by exploiting incomplete path normalization that fails to block backslash-based traversal sequences. Public exploit code exists for this vulnerability, which affects Windows developers and CI/CD pipelines (GitHub Actions, Azure DevOps) and could result in overwriting sensitive configuration files like .npmrc or build configurations. A patch is available in pnpm version 10.28.1 and later.
The Golang sigstore framework versions 1.10.3 and below fail to validate cache directory paths in the legacy TUF client, allowing a malicious TUF repository to overwrite arbitrary files on disk within the calling process's permission scope. This impacts direct users of the TUF client in sigstore/sigstore and older Cosign versions, though public Sigstore deployments are protected by metadata validation from trusted collaborators. No patch is currently available for this medium-severity path traversal vulnerability.
ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when converting floating-point values to strings with high precision. By passing very large `decimalPlaces` values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-size stack buffers, causing memory corruption and denial of service. Under speci...
Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service, allowing attackers to execute arbitrary OS commands.
Improper URI path normalization in Vert.x Web's static file handler allows remote attackers to manipulate the cache and deny access to static files through specially crafted request URIs containing encoded path traversal sequences. An unauthenticated attacker can exploit this vulnerability over the network with no user interaction to cause denial of service by returning HTTP 404 responses for normally accessible files. Public exploit code exists and patches are available.