CVE-2025-30066High· 8.6▾ Abyssal⚠ Exploited in the wildPoC availabletj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at comm…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 47.3 · likelihood 14 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Apr 8, 2025
Last analysed / modified upstream
70%
2 GitHub repos (last check)
Added to the CISA catalog on Mar 18, 2025. Federal remediation due Apr 8, 2025. View catalog ↗
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
changed-files <= 45.0.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-3094Critical· 10.0Malicious backdoor in xz/liblzma (supply-chain compromise)
CVE-2026-67595High· 8.1VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
CVE-2025-59144High· 8.8debug is a JavaScript debugging utility
CVE-2026-95831High· 7.8Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file
CVE-2026-48161Nonereact18-use is a React 19 use hook shim