Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Sep 9, 2026In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure FoldeCVE-2026-15913 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffHigh 7.7
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and InformatioCVE-2026-1089 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.5
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.CVE-2026-0972 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.4
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortra.comseclists.org
Apr 21, 2026An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login CVE-2026-0971 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 4.3
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users toCVE-2025-1241 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.8
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to loCVE-2025-14362 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffHigh 7.3
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH kCVE-2025-8148 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 4.2
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityCVE-2025-10035 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffExploitedRansomwareCritical 10
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- Product
- GoAnywhere MFT
- On CISA’s list since
- Sep 29, 2025 (federal fix deadline Oct 20, 2025)
- What to do
- Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfortra.comcisa.gov
Jul 16, 2025Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere OneCVE-2025-3871 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.3
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emailCVE-2024-11922 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.3
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in cerCVE-2024-9945 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.3
An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checksCVE-2024-25157 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.5
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2024 A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywheCVE-2024-25156 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 6.5
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.CVE-2024-0204 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffCritical 9.8
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 6, 2023Fortra GoAnywhere MFT Remote Code Execution VulnerabilityCVE-2023-0669 · Other software · Fortra · reported by cve@rapid7.comExploitedRansomwareHigh 7.2
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
- Product
- GoAnywhere MFT
- On CISA’s list since
- Feb 10, 2023 (federal fix deadline Mar 3, 2023)
- What to do
- Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comattackerkb.com
Jul 27, 2022A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client.CVE-2021-46830 · Other software · Helpsystems · reported by MITREMedium 6.5
A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. This vulnerability could potentially allow an external user who self-registers with a specific username and/or profile information to gain access to files at a higher directory level than intended.
- Product
- Goanywhere Managed File Transfer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmy.goanywhere.comgoanywhere.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.