GitHub Enterprise Server security vulnerabilities

GitHub Enterprise Server is an open-source application developed by GitHub in the United States. It provides a scalable and easy-to-manage platform by allowing users to set their GitHub instances as virtual devices. Prior to version 3.21 of GitHub Enterprise Server, there was a security...

Heimdallr: Characterizing and Detecting LLM-Induced Security Risks in GitHub CI Workflows

GitHub Continuous Integration CI workflows increasingly integrate Large Language Models LLMs to automate review, triage, content generation, and repository maintenance. This creates a new attack surface: externally controllable workflow inputs can shape LLM prompts and outputs, which may in turn...

CVE-2026-6736: Missing Authentication for Critical Function

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce th...

GitHub Enterprise Server Access Control Vulnerability

GitHub Enterprise Server is an open-source application developed by GitHub in the United States. It provides a scalable and easy-to-manage platform by allowing users to set their GitHub instances as virtual devices. Prior to version 3.21 of GitHub Enterprise Server, there was an access control...

PT-2026-38588

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An authentication bypass allows an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication is enable...

CVE-2026-7541: Allocation of Resources Without Limits or Throttling

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodie...

PT-2026-38593

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An unauthenticated attacker can cause service disruption by sending crafted requests containing deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parses...

GitHub Enterprise Server security vulnerabilities

GitHub Enterprise Server is an open-source application developed by GitHub in the United States. It provides a scalable and easy-to-manage platform by allowing users to set their GitHub instances as virtual devices. Prior to version 3.21 of GitHub Enterprise Server, there was a security...

Cross-site Request Forgery (CSRF)

Overview misp-modules is a MISP modules are autonomous modules that can be used for expansion and other services in MISP Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the home blueprint, which was exempted from CSRF protection. An attacker can perform...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the processFuzzySearch function. An attacker can access and extract the entire database contents by supplying crafted input to the column parameter in the HTTP API, which is directly interpolated into raw SQL statement...

Arbitrary Code Injection

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

CVE-2026-45008

creationtimestamp| type| source ---|---|--- 2026-05-06 20:47:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gh9p-q46p-57g2...

CVE-2026-46359

creationtimestamp| type| source ---|---|--- 2026-05-06 20:44:39+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pm8c-3qq3-72w7...

CVE-2026-45009

creationtimestamp| type| source ---|---|--- 2026-05-06 20:37:42+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jrc5-w569-h7h5...

CVE-2026-46361

creationtimestamp| type| source ---|---|--- 2026-05-06 20:31:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pqh6-8fxf-jx22...

CVE-2026-45007

creationtimestamp| type| source ---|---|--- 2026-05-06 20:24:39+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-rm98-82fr-mcfx...

CVE-2026-46360

creationtimestamp| type| source ---|---|--- 2026-05-06 20:18:48+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-whqh-9pq5-c7r3...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the resetuserpassword and gympermissionsuseredit function when both the attacker and victim have gym=None. An attacker can gain unauthorized access to another user's account, obtain their new plaintext passwor...

CVE-2026-44483

creationtimestamp| type| source ---|---|--- 2026-05-06 19:32:52+00:00| published-proof-of-concept| https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq 2026-05-27 18:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmu3mrz7jk26...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: rustls-openssl-client, sdp-k8s-injector, rpm-sequoia, bootc, deno, typst, valkey-ldap, rustup, sqlx, guestproxyagent, sccache, sentry-cli, komodo, ztunnel-fips, vector...