SonarSource
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| sonarqube-scan-action | 2 | – | Sep 26, 2025 |
| SonarQube | 1 | – | Oct 10, 2025 |
Exploited and recent CVEs
- CVE-2025-62292 In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrato 0.2%
- CVE-2025-59844 Argument injection vulnerability in SonarQube Scan Action 1.5%
- CVE-2025-58178 Command Injection via sonarqube-scan-action GitHub Action 1.1%