Malicious Package

Overview @service-suppliers/fetch-initial-suppliers-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between...

Malicious Package

Overview @service-suppliers/select-supplier-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

MAL-2026-4436 Malicious code in @service-suppliers/select-supplier-watcher-saga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3829c1a8be4ed51ad5c9d714d223cb037f7d76df868b73e63c69c6c60ff8dbf3 On npm install, scripts/postinstall.js fetches a platform-specific script from https://oob.moika.tech/payload/linux|mac|win, writes it to the OS temp...

[SECURITY] Fedora 42 Update: awatcher-0.3.3-2.fc42

A window activity and idle watcher...

[SECURITY] Fedora 43 Update: awatcher-0.3.3-2.fc43

A window activity and idle watcher...

[SECURITY] Fedora 44 Update: awatcher-0.3.3-2.fc44

A window activity and idle watcher...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, azuredisk-csi-fips, kube-fluentd-operator, azure-aad-pod-identity-mic, argo-workflows-fips, commercial-chainloop-cli, traefik, docker-cli-fips, cluster-autoscaler, buildkite-agent-fips, consul, gitlab-pages, harbor-fips, kubernetes, terraform-fips,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: commercial-chainloop-cli, aws-eks-pod-identity-agent-fips, malcontent, flux-operator, sftpgo-plugin-eventsearch, dataplaneapi-fips, flux-image-reflector-controller, karma-fips, commercial-expanso-edge, goreleaser, temporal, grafana-operator,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: commercial-chainloop-cli, aws-eks-pod-identity-agent-fips, malcontent, flux-operator, sftpgo-plugin-eventsearch, dataplaneapi-fips, flux-image-reflector-controller, karma-fips, commercial-expanso-edge, goreleaser, temporal, grafana-operator,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, azuredisk-csi-fips, kube-fluentd-operator, azure-aad-pod-identity-mic, argo-workflows-fips, commercial-chainloop-cli, traefik, docker-cli-fips, cluster-autoscaler, buildkite-agent-fips, consul, gitlab-pages, harbor-fips, kubernetes, terraform-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: influxd, gomplate-fips, cert-manager-cmctl-fips, gomplate, slsa-verifier, timoni, pulumi-language-java, buildkite-agent-fips, xeol, sonobuoy, terraform-fips, kubernetes, kind, minio-fips, cephcsi, commercial-expanso-edge, crane, gitlab-operator, syncthing,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: influxd, gomplate-fips, cert-manager-cmctl-fips, gomplate, slsa-verifier, timoni, pulumi-language-java, buildkite-agent-fips, xeol, sonobuoy, terraform-fips, kubernetes, kind, minio-fips, cephcsi, commercial-expanso-edge, crane, gitlab-operator, syncthing,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation-fips, croc, aws-node-termination-handler, certificate-transparency-fips, sftpgo-plugin-geoipfilter, ceph-csi-operator-fips, gomplate-fips, influxd, crossplane-provider-sql-fips, longhorn-backing-image-manager,...

CVE-2026-28674

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674 xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-28674

Product/Context: xiaoheiFS (self-hosted financial/operational system). Vulnerability: In versions ≤ 0.3.15, the AdminPaymentPluginUpload endpoint allows admins to upload any file to plugins/payment/ with only a hardcoded password (qweasd123456) and disregards file content. A background watcher (S...

EUVD-2026-12702

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ssm-fips, linkerd2, crossplane-provider-aws-sns-fips, harbor-fips, kyverno-policy-reporter, crossplane-provider-aws-iam, flux-source-watcher, livekit-server, nova, dex, apm-server-fips, trivy-operator-fips, crossplane-provider-aws-s3,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ssm-fips, linkerd2, crossplane-provider-aws-sns-fips, harbor-fips, kyverno-policy-reporter, crossplane-provider-aws-iam, flux-source-watcher, livekit-server, nova, dex, apm-server-fips, trivy-operator-fips, crossplane-provider-aws-s3,...