goshs records

12 published records for vendor goshs.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
39Monitor	CVE-2026-35471No exploit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshsgoshs · goshs · CWE-22 Pre-auth Path traversal	Critical9.8	0.6%Apr 6, 2026
39Monitor	CVE-2026-35392No exploit	goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Uploadgoshs · goshs · CWE-22 Pre-auth Path traversal	Critical9.8	0.6%Apr 6, 2026
39Monitor	CVE-2026-35393No exploit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadgoshs · goshs · CWE-22 Pre-auth Path traversal	Critical9.8	0.6%Apr 6, 2026
39Monitor	CVE-2026-40884No exploit	goshs: Empty-username SFTP password authentication bypass in goshsgoshs · goshs · CWE-306 Pre-auth Auth bypass	Critical9.8	0.4%Apr 21, 2026
37Monitor	CVE-2026-40189No exploit	goshs has a file-based ACL authorization bypass in goshs state-changing routesgoshs · goshs · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	0.6%Apr 10, 2026
36Monitor	CVE-2026-40903No exploit	Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistencegoshs · goshs · CWE-829 Pre-auth	Critical9.1	0.2%Apr 21, 2026
34Monitor	CVE-2026-40876No exploit	SFTP root escape via prefix-based path validation in goshsgoshs · goshs · CWE-22 Path traversal	High8.7	0.4%Apr 21, 2026
32Monitor	CVE-2026-34581No exploit	goshs has Auth Bypass via Share Tokengoshs · goshs · CWE-288 Pre-auth Auth bypass	High8.1	0.3%Apr 2, 2026
30Monitor	CVE-2026-40188No exploit	goshs is Missing Write Protection for Parametric Data Valuesgoshs · goshs · CWE-1314	High7.7	0.3%Apr 10, 2026
30Monitor	CVE-2026-40885No exploit	goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized accessgoshs · goshs · CWE-200 Pre-auth Info leak	High7.7	0.3%Apr 21, 2026
26Monitor	CVE-2026-42091No exploit	goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORSgoshs · goshs · CWE-352 Pre-auth CSRF	Medium6.5	0.1%May 4, 2026
24Monitor	CVE-2026-40883No exploit	goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creationgoshs · goshs · CWE-352 Pre-auth CSRF	Medium6.1	0.1%Apr 21, 2026

CVE-2026-35471
39Monitor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
goshs · goshsApr 6, 2026
CVE-2026-35392
39Monitor
goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
goshs · goshsApr 6, 2026
CVE-2026-35393
39Monitor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
goshs · goshsApr 6, 2026
CVE-2026-40884
39Monitor
goshs: Empty-username SFTP password authentication bypass in goshs
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
goshs · goshsApr 21, 2026
CVE-2026-40189
37Monitor
goshs has a file-based ACL authorization bypass in goshs state-changing routes
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
goshs · goshsApr 10, 2026
CVE-2026-40903
36Monitor
Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
goshs · goshsApr 21, 2026
CVE-2026-40876
34Monitor
SFTP root escape via prefix-based path validation in goshs
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
goshs · goshsApr 21, 2026
CVE-2026-34581
32Monitor
goshs has Auth Bypass via Share Token
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
goshs · goshsApr 2, 2026
CVE-2026-40188
30Monitor
goshs is Missing Write Protection for Parametric Data Values
HighCVSS 7.7No exploitEPSS 0%
goshs · goshsApr 10, 2026
CVE-2026-40885
30Monitor
goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Info leak
goshs · goshsApr 21, 2026
CVE-2026-42091
26Monitor
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
goshs · goshsMay 4, 2026
CVE-2026-40883
24Monitor
goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- CSRF
goshs · goshsApr 21, 2026