GitHub vulnerabilities and fixes

CVEs that mention GitHub, ranked by priority. 21 tracked.

GitHub has 21 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-10-23. Highest priority: CVE-2026-61484 (score 61/100).

• CVE-2026-61484 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue
• CVE-2026-48168 CRITICAL 10.0 PraisonAI is a multi-agent teams system
• CVE-2026-61486 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affect
• CVE-2023-2017 HIGH 8.8 UPGRADE Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting bo
• CVE-2026-17556 CRITICAL 9.1 UPGRADE A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated atta
• CVE-2026-47427 HIGH 7.5 UPGRADE GitHub MCP Server is GitHub's official MCP Server
• CVE-2024-3727 HIGH 8.3 A flaw was found in the github.com/containers/image library
• CVE-2026-15996 HIGH 7.5 UPGRADE A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated a
• CVE-2026-11325 HIGH 8.8 Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived re
• CVE-2026-53942 CRITICAL 9.9 Conda Organization Infrastructure is a centralized location for infrastructure codes
• CVE-2026-65675 HIGH 7.1 MITIGATE No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a
• CVE-2026-67322 HIGH 7.5 UPGRADE GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()
• CVE-2026-70335 HIGH 7.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot a
• CVE-2026-50191 HIGH 8.8 4gaBoards is a boards system for realtime project management
• CVE-2026-57113 HIGH 8.1 PraisonAI is a multi-agent teams system
• CVE-2026-93017 HIGH 7.7 The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the
• CVE-2026-106462 MEDIUM 6.4 UPGRADE UPGRADE Backstage is an open framework for building developer portals
• CVE-2026-19361 LOW 3.7 A flaw has been found in macrozheng mall 0504e86
• CVE-2026-54532 MEDIUM 6.9 CloudPirates Open Source Helm Charts is a collection of Helm charts
• CVE-2026-55422 MEDIUM 4.6 conda-forge is a GitHub organization containing repositories of conda recipes
• CVE-2026-61902 HIGH n/a Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progr

FAQ

How do I fix GitHub vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is GitHub being exploited right now?

None of the tracked GitHub CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which GitHub CVE should I patch first?

CVE-2026-61484 currently ranks highest (61/100): ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue .

← Back to latest CVEs