Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

tj-actions

Products: branch-names · changed-files

40.6

Score

2

CVEs

1

Active

1

PoC

1

KEV

#60

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2025-54416	2025-07-26	9.1v3.1	POC	—	Low	Low	no	0.0	branch-names	tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command
CVE-2025-30066	2025-03-15	8.6v3.1	ACTIVE		Low	None	YES	40.6	changed-files	tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3