Serial number: AV26-1007 Date: October 7, 2026 As of October 6, 2026, GitHub is affected by vulnerabilities in the following product: Enterprise Server 3.18.0 Prior to 3.18.16 3.19.0 Prior to 3.19.13 3.20.0 Prior to 3.20.9 3.21.0 Prior to 3.21.7 3.22.0 Prior to 3.22.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Release notes - GitHub Enterprise Server 3.18 Docs Release notes - GitHub Enterprise…
Rilasciati aggiornamenti di sicurezza per risolvere due vulnerabilità, di cui una con gravità "alta", in GitHub Enterprise Server. Un utente autenticato autorizzato a inviare contenuti a un repository potrebbe sfruttare tale vulnerabilità per indurre il sistema a inoltrare richieste opportunamente predisposte verso host interni controllati dall'attaccante al fine di eseguire codice arbitrario sul sistema interessato.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 9.3, CVEs: CVE-2026-77987, CVE-2026-77912, CVE-2026-75101, Summary: GitHub has corrected three vulnerabilities in GitHub Enterprise Server. The most serious is a server-side request forgery vulnerability in the notebook viewer. An attacker could use response timing to extract instance secrets and ultimately execute code on the appliance. Exploitation requires no authentication when private mode is disabled and…
Serial Number: AV26-956Date: September 23, 2026 As of September 22, 2026, GitHub is affected by vulnerabilities in the following product: Enterprise Server 3.17.0 Prior to 3.17.21 3.18.0 Prior to 3.18.15 3.19.0 Prior to 3.19.12 3.20.0 Prior to 3.20.8 3.21.0 Prior to 3.21.6 3.22.0 Prior to 3.22.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Release notes - GitHub Enterprise Server 3.17 Docs Release…
GitHub ha rilasciato aggiornamenti di sicurezza per risolvere 3 vulnerabilità, di cui 1 con gravità "critica" e 1 con gravità "alta", in GitHub Enterprise Server. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato di eseguire codice arbitrario, eludere i meccanismi di sicurezza e accedere a informazioni sensibili sui sistemi interessati.
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.