Ecosystem
GitHub Actions
56 known vulnerabilities.
Most affected packages
step-security/harden-runner 5
shivammathur/setup-php 2
pypa/gh-action-pypi-publish 2
SonarSource/sonarqube-scan-action 2
rlespinasse/github-slug-action 2
tj-actions/branch-names 2
tj-actions/changed-files 2
aquasecurity/trivy-action 2
google-github-actions/run-gemini-cli 1
OZI-Project/publish 1
canonical/get-workflow-version-action 1
actions/runner 1
wktk/conflibot 1
hashicorp/vault-action 1
atlassian/gajira-create 1
dawidd6/action-download-artifact 1
some-natalie/ghas-to-csv 1
lycheeverse/lychee-action 1
Tiryoh/actions-mkdocs 1
ultralytics/actions 1
anthropics/claude-code-action 1
afichet/openexr-viewer 1
gouef/githubtoplanguages 1
RageAgainstThePixel/setup-steamcmd 1
actions/download-artifact 1
SHAdd0WTAka/Zen-Ai-Pentest 1
xygeni/xygeni-action 1
kartverket/github-workflows 1
check-spelling/check-spelling 1
tj-actions/verify-changed-files 1
gradle/gradle-build-action 1
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1
bullfrogsec/bullfrog 1
buildalon/setup-steamcmd 1
Azure/setup-kubectl 1
broadinstitute/cromwell 1
j178/prek-action 1
reviewdog/action-setup 1
njzjz/wenxian 1
super-linter/super-linter 1
1 result · Clear filters · Feed
-
Critical 9.4
Trivy ecosystem supply chain briefly compromised
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…
KEV Mar 26, 2026