tj-actions vulnerabilities

5 CVEs affecting tj-actions products, 1 known to be exploited (CISA KEV), with EPSS scores. Most affected: Branch-Names, Changed-Files, Verify-Changed-Files.