CVE-2025-30066High· 8.6▾ Abyssal⚠ Exploited in the wildPoC availabletj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at comm…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 47.3 · likelihood 14.4 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Apr 8, 2025
Last analysed / modified upstream
70%
70% → 72%
2 GitHub repos (last check)
Added to the CISA catalog on Mar 18, 2025. Federal remediation due Apr 8, 2025. View catalog ↗
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
changed-files <= 45.0.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48027Critical· 9.8Nx Console is the user interface for Nx & Lerna
CVE-2025-59374Critical· 9.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting…
CVE-2024-3094Critical· 10.0Malicious backdoor in xz/liblzma (supply-chain compromise)
CVE-2026-67595High· 8.1VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
CVE-2026-66747Critical· 9.8Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line
CVE-2026-111862Critical· 9.8Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code