How many CVEs does actions have?

actions has 6 published CVE records since 2020, including 1 in the last two years.

How many actions CVEs are in CISA KEV?

None of actions's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which actions products have the most CVEs?

The actions products with the most published CVEs are toolkit, @actions/core, @actions/http-client, @actions/artifact, http-client.

What are the most common weakness types in actions CVEs?

actions's CVEs most often map to these CWE weakness types: CWE-1333 (Inefficient Regular Expression Complexity), CWE-20 (Improper Input Validation), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for actions vulnerabilities?

Yes — 3 of actions's CVEs have a known public exploit.

How many critical actions vulnerabilities are there?

actions has 1 critical and 2 high-severity CVEs.

What is the average severity of actions CVEs?

The average CVSS base score across actions's scored CVEs is 6.9.

actions Vulnerabilities: CVEs, CISA KEV & Security Advisories

Average CVSS: 6.9
Critical / high: 50%
Actively exploited (KEV): 0%
Public exploit available: 50%
Patch available: 100%

actions Vulnerabilities

Overview

Security scorecard

Severity and exploitation

Most affected products

Common weakness types

CNAs that assign these CVEs

Disclosure activity by year

Latest actions CVEs

Other vendors

Frequently asked questions

References

Track actions vulnerabilities