Ecosystem
GitHub Actions
56 known vulnerabilities.
Most affected packages
step-security/harden-runner 5
shivammathur/setup-php 2
pypa/gh-action-pypi-publish 2
SonarSource/sonarqube-scan-action 2
rlespinasse/github-slug-action 2
tj-actions/branch-names 2
tj-actions/changed-files 2
aquasecurity/trivy-action 2
google-github-actions/run-gemini-cli 1
OZI-Project/publish 1
canonical/get-workflow-version-action 1
actions/runner 1
wktk/conflibot 1
hashicorp/vault-action 1
atlassian/gajira-create 1
dawidd6/action-download-artifact 1
some-natalie/ghas-to-csv 1
lycheeverse/lychee-action 1
Tiryoh/actions-mkdocs 1
ultralytics/actions 1
anthropics/claude-code-action 1
afichet/openexr-viewer 1
gouef/githubtoplanguages 1
RageAgainstThePixel/setup-steamcmd 1
actions/download-artifact 1
SHAdd0WTAka/Zen-Ai-Pentest 1
xygeni/xygeni-action 1
kartverket/github-workflows 1
check-spelling/check-spelling 1
tj-actions/verify-changed-files 1
gradle/gradle-build-action 1
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1
bullfrogsec/bullfrog 1
buildalon/setup-steamcmd 1
Azure/setup-kubectl 1
broadinstitute/cromwell 1
j178/prek-action 1
reviewdog/action-setup 1
njzjz/wenxian 1
super-linter/super-linter 1
2 results · Clear filters · Feed
-
High 8.7CVE-2026-31900 Public exploit
Black's vulnerable version parsing leads to RCE in GitHub Action
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request co…
-
High 8.6
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…
KEV Mar 18, 2025