Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Aug 18, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-50139 · Other software · patrickhener · reported by GitHubMedium 5.9
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-50138 · Other software · patrickhener · reported by GitHubHigh 8.1
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026goshs is a feature-rich single-binary file server for red teamers and developers.CVE-2026-66064 · Other software · goshs-labs · reported by GitHubMedium 5.3
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026goshs is a feature-rich single-binary file server for red teamers and developers.CVE-2026-66063 · Other software · goshs-labs · reported by GitHubMedium 6.5
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026goshs is a feature-rich single-binary file server for red teamers and developers.CVE-2026-64863 · Other software · goshs-labs · reported by GitHubCritical 9.1
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026goshs is a feature-rich single-binary file server for red teamers and developers.CVE-2026-62325 · Other software · goshs-labs · reported by GitHubCritical 9.1
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026goshs is a feature-rich single-binary file server for red teamers and developers.CVE-2026-54719 · Other software · goshs-labs · reported by GitHubHigh 7.5
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-42091 · Other software · patrickhener · reported by GitHubMedium 6.5
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network). This issue has been patched in version 2.0.2.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40903 · Other software · patrickhener · reported by GitHubCritical 9.1
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40885 · Other software · patrickhener · reported by GitHubHigh 7.7
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40884 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40883 · Other software · patrickhener · reported by GitHubMedium 6.1
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40876 · Other software · patrickhener · reported by GitHubHigh 8.7
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40189 · Other software · patrickhener · reported by GitHubCritical 9.3
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload, create directories with ?mkdir, and delete files with ?delete inside a .goshs-protected directory. By deleting the .goshs file itself, the attacker can remove the folder's auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability. This vulnerability is fixed in 2.0.0-beta.4.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-40188 · Other software · patrickhener · reported by GitHubHigh 7.7
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-35471 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-35393 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-35392 · Other software · patrickhener · reported by GitHubCritical 9.8
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026goshs is a SimpleHTTPServer written in Go.CVE-2026-34581 · Other software · patrickhener · reported by GitHubHigh 8.1
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025goshs is a SimpleHTTPServer written in Go.CVE-2025-46816 · Other software · patrickhener · reported by GitHubCritical 9.4
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
- Product
- goshs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.