How many sonarsource sonarqube-scan-action CVEs are in CISA KEV?

None of sonarsource sonarqube-scan-action's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of sonarsource sonarqube-scan-action are affected?

39 distinct sonarsource sonarqube-scan-action versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in sonarsource sonarqube-scan-action CVEs?

sonarsource sonarqube-scan-action's CVEs most often map to these CWE weakness types: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')).

What is the average severity of sonarsource sonarqube-scan-action CVEs?

The average CVSS base score across sonarsource sonarqube-scan-action's scored CVEs is 7.8.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

sonarsource

2 CVEs

sonarsource sonarqube-scan-action Vulnerabilities

Name: sonarsource sonarqube-scan-action vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for sonarqube-scan-action by sonarsource.

2

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

7.8

Avg CVSS

2025–2025

Last updated September 26, 2025

Overview

sonarsource sonarqube-scan-action has 2 published CVE records since 2025, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting sonarsource sonarqube-scan-action, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of sonarsource sonarqube-scan-action's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High2

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of sonarsource sonarqube-scan-action's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No sonarsource sonarqube-scan-action CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every sonarsource sonarqube-scan-action version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

11 CVE
1.0.01 CVE
1.1.01 CVE
1.21 CVE
1.2.01 CVE
21 CVE
2.01 CVE
2.0.01 CVE
2.0.11 CVE
2.0.21 CVE
2.11 CVE
2.1.01 CVE
2.21 CVE
2.2.01 CVE
2.31 CVE
2.3.01 CVE
31 CVE
3.01 CVE
3.0.01 CVE
3.11 CVE
3.1.01 CVE
4.01 CVE
4.0.01 CVE
4.11 CVE
4.1.01 CVE
4.2.01 CVE
4.2.11 CVE
5.01 CVE
5.0.01 CVE
5.11 CVE
5.1.01 CVE
5.21 CVE
5.2.01 CVE
5.3.01 CVE
5.3.11 CVE

Version ranges

>= 4, < 5.3.11 CVE
>= 4.0.0, < 6.0.01 CVE

Fixed in

1a6d90ebcb0e6a6b1d87e37ba693fe453195ae251 CVE
fd88b7d7ccbaefd23d8f36f73b59db7a3d2466021 CVE

Find a version

2 CVEs

Sort

Argument injection vulnerability in SonarQube Scan Action
CVE-2025-59844
Patch
CWE-78
High · CVSS 7.7
EPSS 1.5% (72th pct)2025-09-26
Command Injection via sonarqube-scan-action GitHub Action
CVE-2025-58178
Patch
CWE-77
High · CVSS 7.8
EPSS 1.1% (63th pct)2025-09-02

Common weakness types

The CWE weakness categories most often found in sonarsource sonarqube-scan-action CVEs. Follow any weakness for its full explanation.

Other sonarsource products

Browse vulnerabilities for other products by sonarsource.

sonarqube9 CVEs SonarSource/sonarqube-scan-action2 CVEs jenkins plugin1 CVEs org.sonarsource.sonarqube:sonar-web1 CVEs SonarQube Cloud1 CVEs SonarQube Commercial1 CVEs SonarQube Community1 CVEs sonarqube docker image1 CVEs

All sonarsource vulnerabilities

Frequently asked questions

Common questions about sonarsource sonarqube-scan-action vulnerabilities.

How many CVEs does sonarsource sonarqube-scan-action have?: sonarsource sonarqube-scan-action has 2 published CVE records since 2025.
How many sonarsource sonarqube-scan-action CVEs are in CISA KEV?: None of sonarsource sonarqube-scan-action's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for sonarsource sonarqube-scan-action vulnerabilities?: No sonarsource sonarqube-scan-action CVEs currently have a tracked public exploit in this dataset.
Which versions of sonarsource sonarqube-scan-action are affected?: 39 distinct sonarsource sonarqube-scan-action versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in sonarsource sonarqube-scan-action CVEs?: sonarsource sonarqube-scan-action's CVEs most often map to these CWE weakness types: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')).
What is the average severity of sonarsource sonarqube-scan-action CVEs?: The average CVSS base score across sonarsource sonarqube-scan-action's scored CVEs is 7.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track sonarsource sonarqube-scan-action vulnerabilities

Monitor new sonarsource sonarqube-scan-action vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing