GHSA-52XP-W8HR-XV3C

creationtimestamp| type| source ---|---|--- 2026-09-02 02:32:21+00:00| seen| https://gist.github.com/alon710/82c1345fb72ef5ca8fd6cd81e5d856bc...

GHSA-XWPV-PQXP-5V36

creationtimestamp| type| source ---|---|--- 2026-09-02 01:32:29+00:00| seen| https://gist.github.com/alon710/c47c604ce50ae0fa194515af5d7d206b...

CVE-2026-84307

creationtimestamp| type| source ---|---|--- 2026-09-02 01:32:29+00:00| seen| https://gist.github.com/alon710/c47c604ce50ae0fa194515af5d7d206b...

GHSA-R3J6-GPJW-QFJR

creationtimestamp| type| source ---|---|--- 2026-09-02 00:32:16+00:00| seen| https://gist.github.com/alon710/f0327fbec515b265e501091e4bb41d35 2026-09-15 15:00:05+00:00| seen| https://t.me/bdufstecru/3437 2026-09-16 00:00:29+00:00| published-proof-of-concept| https://t.me/bdufstecru/3437...

CVE-2026-84306

creationtimestamp| type| source ---|---|--- 2026-09-02 00:32:16+00:00| seen| https://gist.github.com/alon710/f0327fbec515b265e501091e4bb41d35 2026-09-15 15:00:05+00:00| seen| https://t.me/bdufstecru/3437 2026-09-16 00:00:29+00:00| published-proof-of-concept| https://t.me/bdufstecru/3437...

EUVD-2026-69715

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

EUVD-2026-69714

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

EUVD-2026-69716

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-84305

creationtimestamp| type| source ---|---|--- 2026-09-01 22:35:02+00:00| published-proof-of-concept| https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm 2026-09-02 06:32:30+00:00| seen| https://gist.github.com/alon710/342832b227e98d6656ed29633e96b4ab...

CVE-2026-76851

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-19118

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-18730

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

CVE-2026-76851 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allowed remote code execution on the instance. The root cause was insufficient network isolation that permitted malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests ...

CVE-2026-76851 Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-19118

A time-of-check time-of-use (TOCTOU) race condition in GitHub Enterprise Server enabled remote code execution . Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests . All versions prior to 3.22 were affected; fixes are avai...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-18730

This is a server-side request forgery (SSRF) vulnerability in GitHub Enterprise Server affecting the Manage API . An unauthenticated endpoint parsed an attacker-supplied cluster configuration and issued gateway-to-agent requests whose HMAC authenticated only a timestamp , not the request path or ...

CVE-2026-18730 Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...