Skip to content
OpenAdvisories

Ecosystem

GitHub Actions

56 known vulnerabilities.

Most affected packages

step-security/harden-runner 5 shivammathur/setup-php 2 pypa/gh-action-pypi-publish 2 SonarSource/sonarqube-scan-action 2 rlespinasse/github-slug-action 2 tj-actions/branch-names 2 tj-actions/changed-files 2 aquasecurity/trivy-action 2 google-github-actions/run-gemini-cli 1 OZI-Project/publish 1 canonical/get-workflow-version-action 1 actions/runner 1 wktk/conflibot 1 hashicorp/vault-action 1 atlassian/gajira-create 1 dawidd6/action-download-artifact 1 some-natalie/ghas-to-csv 1 lycheeverse/lychee-action 1 Tiryoh/actions-mkdocs 1 ultralytics/actions 1 anthropics/claude-code-action 1 afichet/openexr-viewer 1 gouef/githubtoplanguages 1 RageAgainstThePixel/setup-steamcmd 1 actions/download-artifact 1 SHAdd0WTAka/Zen-Ai-Pentest 1 xygeni/xygeni-action 1 kartverket/github-workflows 1 check-spelling/check-spelling 1 tj-actions/verify-changed-files 1 gradle/gradle-build-action 1 https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1 bullfrogsec/bullfrog 1 buildalon/setup-steamcmd 1 Azure/setup-kubectl 1 broadinstitute/cromwell 1 j178/prek-action 1 reviewdog/action-setup 1 njzjz/wenxian 1 super-linter/super-linter 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-33634 Exploited Public exploit EPSS 60%

    Trivy ecosystem supply chain briefly compromised

    Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in…

    BerriAI aquasecurity team-telnyx litellm Go GitHub Actions
    KEV Mar 26, 2026
  • High 8.6
    CVE-2025-30154 Exploited

    Multiple Reviewdog actions were compromised during a specific time period

    reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog act…

    reviewdog reviewdog reviewdog/action-setup GitHub Actions
    KEV Mar 24, 2025
  • High 8.6
    CVE-2025-30066 Exploited Public exploit EPSS 72%

    tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…

    tj-actions changed-files tj-actions/changed-files GitHub Actions
    KEV Mar 18, 2025