Ecosystem
GitHub Actions
56 known vulnerabilities.
Most affected packages
step-security/harden-runner 5
shivammathur/setup-php 2
pypa/gh-action-pypi-publish 2
SonarSource/sonarqube-scan-action 2
rlespinasse/github-slug-action 2
tj-actions/branch-names 2
tj-actions/changed-files 2
aquasecurity/trivy-action 2
google-github-actions/run-gemini-cli 1
OZI-Project/publish 1
canonical/get-workflow-version-action 1
actions/runner 1
wktk/conflibot 1
hashicorp/vault-action 1
atlassian/gajira-create 1
dawidd6/action-download-artifact 1
some-natalie/ghas-to-csv 1
lycheeverse/lychee-action 1
Tiryoh/actions-mkdocs 1
ultralytics/actions 1
anthropics/claude-code-action 1
afichet/openexr-viewer 1
gouef/githubtoplanguages 1
RageAgainstThePixel/setup-steamcmd 1
actions/download-artifact 1
SHAdd0WTAka/Zen-Ai-Pentest 1
xygeni/xygeni-action 1
kartverket/github-workflows 1
check-spelling/check-spelling 1
tj-actions/verify-changed-files 1
gradle/gradle-build-action 1
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1
bullfrogsec/bullfrog 1
buildalon/setup-steamcmd 1
Azure/setup-kubectl 1
broadinstitute/cromwell 1
j178/prek-action 1
reviewdog/action-setup 1
njzjz/wenxian 1
super-linter/super-linter 1
2 results · Clear filters · Feed
-
High 8.6CVE-2025-30154 Exploited
Multiple Reviewdog actions were compromised during a specific time period
reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog act…
KEV Mar 24, 2025 -
High 8.6
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…
KEV Mar 18, 2025