Ppatrickhener

Products

Exploited and recent CVEs

• CVE-2026-50139 Medium 5.9 goshs: Share-link ?token=… redemption races past download limit 0.3%
• CVE-2026-50138 High 8.1 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags 0.4%
• CVE-2026-42091 Medium 6.5 goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS 0.2%
• CVE-2026-40903 Critical 9.1 Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence 0.2%
• CVE-2026-40885 High 7.7 goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access 0.3%
• CVE-2026-40884 Critical 9.8 goshs: Empty-username SFTP password authentication bypass in goshs 0.5%
• CVE-2026-40883 Medium 6.1 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation 0.1%
• CVE-2026-40876 High 8.7 SFTP root escape via prefix-based path validation in goshs 0.4%
• CVE-2026-40189 Critical 9.3 goshs has a file-based ACL authorization bypass in goshs state-changing routes 0.6%
• CVE-2026-40188 High 7.7 goshs is Missing Write Protection for Parametric Data Values 0.3%
• CVE-2026-35471 Critical 9.8 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs 0.7%
• CVE-2026-35393 Critical 9.8 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload 0.7%
• CVE-2026-35392 Critical 9.8 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload 0.7%
• CVE-2026-34581 High 8.1 goshs has Auth Bypass via Share Token 0.4%
• CVE-2025-46816 Critical 9.4 goshs route not protected, allows command execution 0.8%