Vulnerabilities
Summary — last 7 days
New vulnerabilities5,170▲ 2,078 vs. last week
Critical / high2,875▲ 1,376 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)184▼ 23 vs. last week
4 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.1) | 1.2% | — | Github Codeql ActionAIGithub Codeql CLIAI | 1/24/2025 | 6/17/2026 | In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access… | |
| Analyzed | Medium (5.5) | 0.77% | — | Github Codeql CLI | 2/22/2024 | 6/17/2026 | The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously modified CodeQL… | |
| Modified | Medium (4.4) | 0.40% | — | Github Codeql Action | 5/25/2021 | 6/17/2026 | Github's CodeQL action is provided to run CodeQL-based code scanning on non-GitHub CI/CD systems and requires a GitHub access token to connect to a GitHub repository. The runner and its documentation previously suggested passing the GitHub token as a command-line parameter to the process instead of reading it from a… | |
| Modified | High (7.8) | 5.4% | — | Microsoft Codeql | 11/25/2019 | 6/17/2026 | If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using… |