Ecosystem
GitHub Actions
56 known vulnerabilities.
Most affected packages
step-security/harden-runner 5
shivammathur/setup-php 2
pypa/gh-action-pypi-publish 2
SonarSource/sonarqube-scan-action 2
rlespinasse/github-slug-action 2
tj-actions/branch-names 2
tj-actions/changed-files 2
aquasecurity/trivy-action 2
google-github-actions/run-gemini-cli 1
OZI-Project/publish 1
canonical/get-workflow-version-action 1
actions/runner 1
wktk/conflibot 1
hashicorp/vault-action 1
atlassian/gajira-create 1
dawidd6/action-download-artifact 1
some-natalie/ghas-to-csv 1
lycheeverse/lychee-action 1
Tiryoh/actions-mkdocs 1
ultralytics/actions 1
anthropics/claude-code-action 1
afichet/openexr-viewer 1
gouef/githubtoplanguages 1
RageAgainstThePixel/setup-steamcmd 1
actions/download-artifact 1
SHAdd0WTAka/Zen-Ai-Pentest 1
xygeni/xygeni-action 1
kartverket/github-workflows 1
check-spelling/check-spelling 1
tj-actions/verify-changed-files 1
gradle/gradle-build-action 1
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs 1
bullfrogsec/bullfrog 1
buildalon/setup-steamcmd 1
Azure/setup-kubectl 1
broadinstitute/cromwell 1
j178/prek-action 1
reviewdog/action-setup 1
njzjz/wenxian 1
super-linter/super-linter 1
1 result · Clear filters · Feed
-
Medium 5.6CVE-2026-46420 Public exploit
setup-php: Command Injection in Repository-Derived PHP Version Resolution
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock t…