CVE-2025-11578 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...

CVE-2025-11578 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...

CVE-2025-11892 DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have...

CVE-2025-11892

GitHub Enterprise Server is affected by CVE-2025-11892: an improper neutralization of input leads to DOM-based cross-site scripting via the Issues search label filter, enabling privilege escalation and unauthorized workflow triggers. Exploitation requires user interaction and access to a target s...

CVE-2025-11892 DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the flow.eyen function. An attacker can trigger a segmentation fault by adding a Python sequence to the native code. PoC python import oneflow as flow diag = 1.0, 2.0, 3.0 tensor = flow.eye3 + diag...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability in GitHub Enterprise Server versions prior t...

PT-2025-46217

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.19 GitHub Enterprise Server versions 3.14.19 GitHub Enterprise Server versions 3.15.14 GitHub Enterprise Server versions 3.16.10 GitHub Enterprise Server versions 3.17.7 GitHub Enterprise Server...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions...

PT-2025-46218

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.18.1 GitHub Enterprise Server versions prior to 3.17.7 GitHub Enterprise Server versions prior to 3.16.10 GitHub Enterprise Server versions prior to 3.15.14 GitHub Enterprise Server versions prior t...

VulnCheck KEV: CVE-2017-18365

The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a...

GHSA-PWHC-RPQ9-4C8W vulnerabilities

Vulnerabilities for packages: helm-operator, k8ssandra-client, cert-manager-cmctl, fuse-overlayfs-snapshotter, kargo, grype, neuvector-scanner, helm-set-status, opa-envoy, dagger, containerd, kubescape-operator, xeol, zarf, skaffold, helm, helm-push, docker, cilium-cli, docker-compose, syft,...

Fedora 41 : golang-github-openprinting-ipp-usb (2025-9d12a32bce)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9d12a32bce advisory. Rebuild with the latest golang in repos Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

GHSA-M6HQ-P25P-FFR2 vulnerabilities

Vulnerabilities for packages: k3s, kubevela-fips, livekit-cli, docker-compose, trivy-operator, gogatekeeper, apm-server-fips, dagger, zot, datadog-agent-fips, opa, k9s, cilium-cli, gitlab-operator, trivy, neuvector-scanner, helm-push, fuse-overlayfs-snapshotter, opa-fips-envoy, rancher-agent,...

Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities

Cybersecurity researchers have flagged a malicious Visual Studio Code VS Code extension with basic ransomware capabilities that appears to be created with the help of artificial intelligence – in other words, vibe-coded. Secure Annex researcher John Tuckner, who flagged the extension "susvsex,"...

CVE-2025-61299

creationtimestamp| type| source ---|---|--- 2025-11-07 05:43:37+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/58649 2025-11-07 09:00:04+00:00| published-proof-of-concept| Telegram/rxBXc7mJGGU5sBhvwkQkmojEU4Xu3I8--yJupvnllAH1D4...

EUVD-2025-8630

archives is a Go library for extracting archives tar, zip, etc.. Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the...

BIT-MASTODON-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon

Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0...

CVE-2025-64109

Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP Model Context Protocol server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in ...

GO-2025-4088 sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls

sqls-server/sqls is vulnerable to command injection in the config command in github.com/sqls-server/sqls...