Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Aug 18, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-50139 · Other software · patrickhener · reported by GitHubMedium 5.9
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-50138 · Other software · patrickhener · reported by GitHubHigh 8.1
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-42091 · Other software · patrickhener · reported by GitHubMedium 6.5
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network). This issue has been patched in version 2.0.2.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40903 · Other software · patrickhener · reported by GitHubCritical 9.1
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40885 · Other software · patrickhener · reported by GitHubHigh 7.7
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40884 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40883 · Other software · patrickhener · reported by GitHubMedium 6.1
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40876 · Other software · patrickhener · reported by GitHubHigh 8.7
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40189 · Other software · patrickhener · reported by GitHubCritical 9.3
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload, create directories with ?mkdir, and delete files with ?delete inside a .goshs-protected directory. By deleting the .goshs file itself, the attacker can remove the folder's auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability. This vulnerability is fixed in 2.0.0-beta.4.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40188 · Other software · patrickhener · reported by GitHubHigh 7.7
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-35471 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-35393 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-35392 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-34581 · Other software · patrickhener · reported by GitHubHigh 8.1
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025goshs is a SimpleHTTPServer written in Go.CVE-2025-46816 · Other software · patrickhener · reported by GitHubCritical 9.4
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2018A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.CVE-2018-16478 · Other software · Simplehttpserver Project · reported by support@hackerone.comMedium 5.3
A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.
- Product
- Simplehttpserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Aug 31, 2018Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.CVE-2018-3787 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
- Product
- simplehttpserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Jun 6, 2018simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.CVE-2018-3716 · Other software · HackerOne · reported by support@hackerone.comMedium 5.4
simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
- Product
- simplehttpserver node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 31, 2018Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`.CVE-2016-10561 · Other software · HackerOne · reported by support@hackerone.comMedium 5.3
Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests.
- Product
- bitty node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 27, 2012The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not plaCVE-2011-4940 · Other software · Python · reported by Red HatLow 2.6
The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.
- Product
- Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.