PT-2026-97052

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.17 through 3.22 Description A server-side request forgery SSRF issue exists in the notebook viewer. While the system validates the scheme and host of a user-supplied URL, it fails to validate the port. This...

CVE-2026-77987: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-75101: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

ROS-20260922-73-0113

The vulnerability in golang-github-rancher-local-path-provisioner is related to errors in handling relative pathnames to the directory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

OPENSUSE-SU-2026:11853-1 golang-github-v2fly-v2ray-core-5.54.2-1.1 on GA media

These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.54.2-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-JR34-H97M-9HPX

creationtimestamp| type| source ---|---|--- 2026-09-21 23:31:26+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc 2026-09-22 00:01:48+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc...

CVE-2026-61629

creationtimestamp| type| source ---|---|--- 2026-09-21 22:35:04+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx 2026-09-21 23:31:26+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc 2026-09-22...

CVE-2026-61628

creationtimestamp| type| source ---|---|--- 2026-09-21 22:32:02+00:00| seen| https://gist.github.com/alon710/c22586b9d9c77f8331c17f01285d9c0d 2026-09-21 22:35:02+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5 2026-09-21...

CVE-2026-46649

creationtimestamp| type| source ---|---|--- 2026-09-21 21:57:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6edxc5mjk3766 2026-09-21 22:07:23+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mw2pwrg2qz2g 2026-09-21 22:20:05+00:00| seen|...

GHSA-X5FP-WJ9C-MXMX

creationtimestamp| type| source ---|---|--- 2026-09-21 19:09:37+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5 2026-09-28 18:39:22+00:00| seen| https://gist.github.com/tomasantunes/b27c1462edf01f28a31f453280d86577...

GHSA-V245-V573-V5VM

creationtimestamp| type| source ---|---|--- 2026-09-21 19:09:16+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5...

GHSA-22P9-WV53-3RQ4

creationtimestamp| type| source ---|---|--- 2026-09-21 19:08:55+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5...

GHSA-6V5V-WF23-FMFQ

creationtimestamp| type| source ---|---|--- 2026-09-21 19:08:32+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5 2026-10-01 02:50:35+00:00| seen| https://gist.github.com/sjl75050101-netizen/3ab4749268f0ca0bc82ea9748a2e6b25...

GHSA-Q8MJ-M7CP-5Q26

creationtimestamp| type| source ---|---|--- 2026-09-21 19:08:10+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5...

GHSA-4MJR-XMP4-GH2G

creationtimestamp| type| source ---|---|--- 2026-09-21 19:07:49+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5 2026-09-28 18:39:22+00:00| seen| https://gist.github.com/tomasantunes/b27c1462edf01f28a31f453280d86577...

CVE-2026-61687

creationtimestamp| type| source ---|---|--- 2026-09-21 16:31:47+00:00| seen| https://gist.github.com/alon710/cd3d4f295cb3f81bbf208f1f924aafe9...

CVE-2026-16651

creationtimestamp| type| source ---|---|--- 2026-09-21 16:01:32+00:00| seen| https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a 2026-09-22 11:40:51+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mw45fe6kuf2k...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

EUVD-2026-83981

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...