Microsoft GitHub Enterprise Server: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren und offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2026-43343 linked CVEs
Open advisory with all CVEs
More on GitHub
Other advisories
- HighCVE-2026-123852JetBrains Junie GitHub Action: fehlerhafte Autorisierung
- MediumCVE-2026-123851JetBrains Junie GitHub Action: Sicherheitslücke
- HighCVE-2026-123852JetBrains Junie GitHub Action: fehlerhafte Autorisierung
- MediumCVE-2026-123851JetBrains Junie GitHub Action: Sicherheitslücke
- Highpwn_watch:claude-code-settings-local-json-secrets-exposure-nov-2026Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets
- HighCVE-2026-110288Microsoft GitHub Enterprise Server: Mehrere Schwachstellen
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-116587CVE-2026-116587 in github.com/go-jose/go-jose/v4 - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-34986CVE-2026-34986 in github.com/go-jose/go-jose/v4 - Patched by Root
Other news entries
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubNewsThe Hacker News
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Fake security tools on GitHub push backdoors and infostealersNewsBleepingComputer
- Threat actors use agentic AI tooling to find and abuse exposed secretsNewsMicrosoft Threat Intelligence
- GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secretsBreachpwn.watch
- Hugging Face malware campaign returns to hijack GPUs for crypto miningNewsBleepingComputer
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto MinersNewsThe Hacker News
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hourNewsThe Register — Security
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4334
ID