# GitHub Enterprise Server vulnerabilities Source: https://junglewise.ai/threats/technologies/github-enterprise-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-enterprise-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in GitHub Enterprise Server: 0 in the last 7 days and 8 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118237, was published on 3 November 2026. 3 vulnerabilities in the last four weeks, down 40% on the four before (5). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 8 - All time: 14 (2 critical, 0 exploited in the wild) ## About GitHub Enterprise Server On-premises version of GitHub's collaboration platform for version control and team coordination. ## Latest GitHub Enterprise Server vulnerabilities - [CVE-2026-118237: GitHub Enterprise Server out-of-bounds read in SSH key negotiation](https://junglewise.ai/threats/cve-2026-118237-an-out-of-bounds-read-vulnerability-was-identified-in-github) (info, published 3 Nov 2026) - [CVE-2026-110288: GitHub Enterprise Server CSRF in ChatOps integration removal](https://junglewise.ai/threats/cve-2026-110288-a-cross-site-request-forgery-vulnerability-was-identified-in) (info, published 3 Nov 2026) - [CVE-2026-104608: GitHub Enterprise Server use-after-free in Git service babeld](https://junglewise.ai/threats/cve-2026-104608-a-remote-code-execution-vulnerability-was-identified-in-github) (info, published 3 Nov 2026) - [CVE-2026-96890: GitHub Enterprise Server SSRF in secret scanning validator](https://junglewise.ai/threats/cve-2026-96890-a-server-side-request-forgery-ssrf-vulnerability-was-identified) (info, published 6 Oct 2026) - [CVE-2026-103620: GitHub Enterprise Server missing authorization in GraphQL API](https://junglewise.ai/threats/cve-2026-103620-a-missing-authorization-vulnerability-was-identified-in-github) (info, published 6 Oct 2026) - [CVE-2026-77987: GitHub Enterprise Server notebook viewer SSRF](https://junglewise.ai/threats/cve-2026-77987-a-server-side-request-forgery-ssrf-vulnerability-was-identified) (info, published 22 Sep 2026) - [CVE-2026-77912: GitHub Enterprise Server stored XSS in Markdown rendering](https://junglewise.ai/threats/cve-2026-77912-a-stored-cross-site-scripting-xss-vulnerability-was-identified-in) (info, published 22 Sep 2026) - [CVE-2026-75101: GitHub Enterprise Server authorization bypass in pull request diffs](https://junglewise.ai/threats/cve-2026-75101-an-authorization-bypass-vulnerability-was-identified-in-github) (info, published 22 Sep 2026) - [CVE-2026-5921: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker…](https://junglewise.ai/threats/cve-2026-5921-a-server-side-request-forgery-ssrf-vulnerability-was-identified-in) (high, CVSS 8.9, published 21 Apr 2026) - [CVE-2026-5845: An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise…](https://junglewise.ai/threats/cve-2026-5845-an-improper-authorization-vulnerability-in-scoped-user-to-server) (critical, CVSS 9.6, published 21 Apr 2026) - [CVE-2026-5512: An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated…](https://junglewise.ai/threats/cve-2026-5512-an-improper-authorization-vulnerability-was-identified-in-github) (medium, CVSS 4.3, published 21 Apr 2026) - [CVE-2026-4296: An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to…](https://junglewise.ai/threats/cve-2026-4296-an-incorrect-regular-expression-vulnerability-was-identified-in) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-3307: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin…](https://junglewise.ai/threats/cve-2026-3307-an-authorization-bypass-vulnerability-was-identified-in-github) (low, CVSS 2.7, published 21 Apr 2026) - [CVE-2025-11892: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based…](https://junglewise.ai/threats/cve-2025-11892-an-improper-neutralization-of-input-vulnerability-was-identified) (critical, CVSS 9.6, published 10 Nov 2025) ## Most severe GitHub Enterprise Server vulnerabilities - [CVE-2025-11892: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based…](https://junglewise.ai/threats/cve-2025-11892-an-improper-neutralization-of-input-vulnerability-was-identified) (critical, CVSS 9.6, published 10 Nov 2025) - [CVE-2026-5845: An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise…](https://junglewise.ai/threats/cve-2026-5845-an-improper-authorization-vulnerability-in-scoped-user-to-server) (critical, CVSS 9.6, published 21 Apr 2026) - [CVE-2026-5921: A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker…](https://junglewise.ai/threats/cve-2026-5921-a-server-side-request-forgery-ssrf-vulnerability-was-identified-in) (high, CVSS 8.9, published 21 Apr 2026) - [CVE-2026-4296: An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to…](https://junglewise.ai/threats/cve-2026-4296-an-incorrect-regular-expression-vulnerability-was-identified-in) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-5512: An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated…](https://junglewise.ai/threats/cve-2026-5512-an-improper-authorization-vulnerability-was-identified-in-github) (medium, CVSS 4.3, published 21 Apr 2026) - [CVE-2026-3307: An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin…](https://junglewise.ai/threats/cve-2026-3307-an-authorization-bypass-vulnerability-was-identified-in-github) (low, CVSS 2.7, published 21 Apr 2026) - [CVE-2026-77987: GitHub Enterprise Server notebook viewer SSRF](https://junglewise.ai/threats/cve-2026-77987-a-server-side-request-forgery-ssrf-vulnerability-was-identified) (info, published 22 Sep 2026) - [CVE-2026-77912: GitHub Enterprise Server stored XSS in Markdown rendering](https://junglewise.ai/threats/cve-2026-77912-a-stored-cross-site-scripting-xss-vulnerability-was-identified-in) (info, published 22 Sep 2026) - [CVE-2026-75101: GitHub Enterprise Server authorization bypass in pull request diffs](https://junglewise.ai/threats/cve-2026-75101-an-authorization-bypass-vulnerability-was-identified-in-github) (info, published 22 Sep 2026) - [CVE-2026-118237: GitHub Enterprise Server out-of-bounds read in SSH key negotiation](https://junglewise.ai/threats/cve-2026-118237-an-out-of-bounds-read-vulnerability-was-identified-in-github) (info, published 3 Nov 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 40% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other GitHub technologies - [GitHub ViewComponent](https://junglewise.ai/threats/technologies/viewcomponent): 4 vulnerabilities - [GitHub Electron](https://junglewise.ai/threats/technologies/github-electron): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "GitHub Enterprise Server vulnerabilities", https://junglewise.ai/threats/technologies/github-enterprise-server, 11 November 2026.