Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-5wxr-w449-57cm
  • GitHub Actions/shivammathur/setup-php
 Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions 20 May
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-pqwm-q9pv-ph8r
  • GitHub Actions/shivammathur/setup-php
 Setup PHP: Command Injection in Repository-Derived PHP Version Resolution 20 May
  • Fix available
  • Severity - 5.6 (Medium)
GHSA-wpqr-6v78-jr5g
  • GitHub Actions/google-github-actions/run-gemini-cli
  • npm/@google/gemini-cli
 Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses 24 Apr
  • Fix available
  • Severity - 10.0 (Critical)
GHSA-6p2j-742g-835f
  • GitHub Actions/Tiryoh/actions-mkdocs
 actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow 04 Apr
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-r4fj-r33x-8v88
  • GitHub Actions/njzjz/wenxian
 wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` 29 Mar
  • No fix available
  • Severity - 9.8 (Critical)
GHSA-69fq-xp46-6x23
  • GitHub Actions/aquasecurity/setup-trivy
  • GitHub Actions/aquasecurity/trivy-action
  • Go/github.com/aquasecurity/trivy
 Trivy ecosystem supply chain was briefly compromised 24 Mar
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-f67f-hcr6-94mf
  • GitHub Actions/SHAdd0WTAka/Zen-Ai-Pentest
 Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow 20 Mar
  • No fix available
  • Severity - 10.0 (Critical)
GHSA-46g3-37rh-v698
  • GitHub Actions/step-security/harden-runner
 Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier) 17 Mar
  • Fix available
  • Severity - 4.6 (Medium)
GHSA-g699-3x6g-wm3g
  • GitHub Actions/step-security/harden-runner
 Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier) 17 Mar
  • Fix available
  • Severity - 4.6 (Medium)
GHSA-f8q5-h5qh-33mh
  • GitHub Actions/xygeni/xygeni-action
 xygeni-action v5 tag poisoned with C2 backdoor 11 Mar
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-v53h-f6m7-xcgm
  • GitHub Actions/psf/black
 Black's vulnerable version parsing leads to RCE in GitHub Action 07 Mar
  • Fix available
  • Severity - 8.7 (High)
GHSA-9p44-j4g5-cfx5
  • GitHub Actions/aquasecurity/trivy-action
 Trivy Action has a script injection via sourced env file in composite action 18 Feb
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-r79c-pqj3-577x
  • GitHub Actions/super-linter/super-linter
  • GitHub Actions/super-linter/super-linter/slim
 Super-linter is vulnerable to command injection via crafted filenames in Super-linter Action 09 Feb
  • Fix available
  • Severity - 8.8 (High)
GHSA-cpmj-h4f6-r6pq
  • GitHub Actions/step-security/harden-runner
 Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier) 09 Feb
  • Fix available
  • Severity - 6.0 (Medium)
GHSA-pwf7-47c3-mfhx
  • GitHub Actions/j178/prek-action
 j178/prek-action vulnerable to arbitrary code injection in composite action 29 Sep 2025
  • Fix available
  • Severity - 9.9 (Critical)
GHSA-5xq9-5g24-4g6f
  • GitHub Actions/SonarSource/sonarqube-scan-action
 Argument injection vulnerability in SonarQube Scan Action 26 Sep 2025
  • Fix available
  • Severity - 7.7 (High)
Load more...(3 pages left)