CVE-2024-6800Critical· 9.5▾ MidnightAn XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.5%
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.
enterprise_server >= 3.13.0 <= 3.13.2enterprise_server >= 3.12.0 <= 3.12.7enterprise_server >= 3.11.0 <= 3.11.13enterprise_server >= 3.10.0 <= 3.10.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-24807MediumQuick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
CVE-2026-118237Medium· 5.3Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service
CVE-2026-104608High· 7.7Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
CVE-2026-110288Medium· 5.3Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
CVE-2026-15343High· 8.6A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow …
CVE-2026-29783High· 7.8The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns