Gophish gophish

• CVE-2026-107273 Medium 4.3 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site 0.2%
• CVE-2026-107272 Medium 4.7 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages 0.2%
• CVE-2026-107271 Medium 5.3 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing 0.2%
• CVE-2026-107270 High 7.1 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints 0.2%
• CVE-2026-107269 Low 3.7 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy 0.2%
• CVE-2026-82269 High 8.1 Gophish Account Lockout and Forced Password Change Bypassable via API Key 0.6%
• CVE-2026-39904 Medium 6.5 Gophish 0.12.1 Denial of Service via Office Document Upload 0.4%