# GitHub Actions


- [CVE-2026-33634](https://insights.sbomify.com/CVE-2026-33634/): Aquasecurity Trivy Embedded Malicious Code (critical 9.4, exploited in the wild)
- [CVE-2025-30154](https://insights.sbomify.com/CVE-2025-30154/): reviewdog/action-setup GitHub Action Embedded Malicious Code (high 8.6, exploited in the wild)
- [CVE-2025-30066](https://insights.sbomify.com/CVE-2025-30066/): tj-actions/changed-files GitHub Action Embedded Malicious Code (high 8.6, exploited in the wild)
- [CVE-2026-12537](https://insights.sbomify.com/CVE-2026-12537/): Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows (critical 10.0)
- [CVE-2021-32724](https://insights.sbomify.com/CVE-2021-32724/): check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack (critical 9.9)
- [CVE-2026-34243](https://insights.sbomify.com/CVE-2026-34243/): wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` (critical 9.8)
- [CVE-2023-50245](https://insights.sbomify.com/CVE-2023-50245/): OpenEXR-viewer memory overflow vulnerability (critical 9.8)
- [CVE-2020-14188](https://insights.sbomify.com/CVE-2020-14188/): gajira-create GitHub action vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2026-31976](https://insights.sbomify.com/CVE-2026-31976/): xygeni-action v5 tag poisoned with C2 backdoor (critical 9.3)
- [CVE-2023-49291](https://insights.sbomify.com/CVE-2023-49291/): Improper Sanitization of Branch Name Leads to Arbitrary Code Injection (critical 9.3)
- [CVE-2026-55158](https://insights.sbomify.com/CVE-2026-55158/): Conflibot: Command injection via crafted pull request branch names under pull_request_target (critical 9.1)
- [CVE-2025-54416](https://insights.sbomify.com/CVE-2025-54416/): tj-actions/branch-names Contains Command Injection Vulnerability (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/github-actions/