CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
TanStack npm Packages Supply Chain Compromise via GitHub Actions OIDC Exploitation (CVE-2026-45321)
[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11
[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens
[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials
Aqua Security Trivy Supply Chain Attack and Malicious Release (CVE-2026-33634) Critical Security Advisory
[Affected Scope] Trivy Go/Container image v0.69.4, trivy-action v0.0.1 to v0.34.2 (76 tags), setup-trivy v0.2.0 to v0.2.6
[Impact] A threat actor used compromised credentials to force-push malicious commits to version tags, enabling credential exfiltration from CI/CD pipelines
[Mitigation] Upgrade to safe versions (Trivy v0.69.2/v0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6 recreated) and pin actions to immutable commit SHAs
GitHub Actions reviewdog/action-setup Supply Chain Compromise and Secrets Leak (CVE-2025-30154)
[Affected Scope] Workflows executing reviewdog/action-setup@v1 and dependent actions between March 11, 2025, 18:42 and 20:31 UTC
[Impact] Malicious code injected into the action dumps exposed secrets to GitHub Actions Workflow Logs, leading to potential credential theft
[Mitigation] Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes
tj-actions changed-files GitHub Action Supply Chain Compromise and Malicious Code Injection (CVE-2025-30066)
[Affected Scope] GitHub Actions workflows utilizing tj-actions/changed-files action versions v1 through v45.0.7
[Impact] Threat actors modified release tags to point to a malicious commit (0e58ed8), enabling execution of malicious code ('updateFeatures') and exfiltration of GitHub Secrets via action logs
[Mitigation] Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA