GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, oras-fips, flux-source-controller, tailscale, malcontent, apko, metacontroller, aws-privateca-issuer-fips, rabbitmq-messaging-topology-operator, grafana-operator-fips, karma-fips, dgraph, pluto, atlas, flux-helm-controller, supercronic, dapr-fips...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, kyverno-fips, jaeger-fips, cluster-autoscaler, terraform, mattermost, beats, knative-operator-fips, azurefile-csi, cloud-provider-aws-fips, gitlab-kas, argo-workflows, gitaly-fips, argo-cd-fips, ingress-nginx-controller-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, kyverno-fips, jaeger-fips, beats, caddy, cloud-provider-aws-fips, mailpit, seaweedfs-fips, backup-restore-operator-fips, docker-cli-buildx, flux-helm-controller, falcoctl-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, kyverno-fips, jaeger-fips, beats, caddy, cloud-provider-aws-fips, mailpit, seaweedfs-fips, backup-restore-operator-fips, docker-cli-buildx, flux-helm-controller, falcoctl-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, k8sgpt-operator, gpu-operator, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, git-sync, terraform-provider-time-fips, beats,...

CVE-2026-28674

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

EUVD-2026-12702

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674 xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674

Product/Context: xiaoheiFS (self-hosted financial/operational system). Vulnerability: In versions ≤ 0.3.15, the AdminPaymentPluginUpload endpoint allows admins to upload any file to plugins/payment/ with only a hardcoded password (qweasd123456) and disregards file content. A background watcher (S...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: flux-source-watcher, trivy-operator, crossplane-provider-aws-rolesanywhere-fips, grafana-alloy, crossplane-provider-aws-elasticache-fips, fleet-server, crossplane-provider-aws-cloudfront, gpu-operator, seaweedfs-operator, terraform-provider-acme, apko, mattermost,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, trivy-operator, crossplane-provider-aws-rolesanywhere-fips, grafana-alloy, crossplane-provider-aws-elasticache-fips, fleet-server, crossplane-provider-aws-cloudfront, gpu-operator, seaweedfs-operator, terraform-provider-acme, apko, mattermost,...

CVE-2020-37200

NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration key input that allows attackers to crash the application by supplying oversized input. Attackers can generate a 1000-character payload and paste it into the registration key field to trigger an application crash...

CVE-2020-36985

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...

CVE-2020-36985 IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...

CVE-2020-36985 IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...

CVE-2020-36985

IP Watcher 3.0.0.30 is affected by an unquoted service path vulnerability in its Windows service PACService.exe; the underlying issue is an unquoted binary path that allows local attackers to inject executables and run with elevated LocalSystem privileges at service startup. Documents confirm the...

EUVD-2020-30893

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...

CVE-2020-36985: Unquoted Search Path or Element

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...

PT-2026-5111

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated LocalSystem privileges...