https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 31 Jul 2026 17:44:21 +0000 https://vulnerability.circl.lu/sighting/d9460be9-917e-4e69-84c5-95445dae2f2d/export {"uuid": "d9460be9-917e-4e69-84c5-95445dae2f2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54719", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmn3mrjz2d", "content": "\ud83d\udfe0 CVE-2026-54719 - High (7.5)\n\ngoshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54719/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T00:00:53.945782Z"} {"uuid": "d9460be9-917e-4e69-84c5-95445dae2f2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54719", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmn3mrjz2d", "content": "\ud83d\udfe0 CVE-2026-54719 - High (7.5)\n\ngoshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54719/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T00:00:53.945782Z"} https://vulnerability.circl.lu/sighting/d9460be9-917e-4e69-84c5-95445dae2f2d/export Wed, 29 Jul 2026 00:00:53 +0000 https://vulnerability.circl.lu/sighting/8c82b4f1-e43e-4085-b171-1e6aa21d6cfa/export {"uuid": "8c82b4f1-e43e-4085-b171-1e6aa21d6cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54719", "type": "seen", "source": "https://gist.github.com/alon710/9b8006195456ffdcd967a102fe0db5d4", "content": "# CVE-2026-54719: CVE-2026-54719: Access Control List Authorization Bypass in goshs via bulk ZIP Download Route\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54719\n\n## Summary\nCVE-2026-54719 is a high-severity Access Control List (ACL) authorization bypass vulnerability in goshs, a lightweight HTTPS-capable server used for file sharing. The issue allows unauthenticated network attackers to completely bypass file-level and directory-level authentication mechanisms and blocklists by requesting protected resources via the bulk ZIP-download route (?bulk). This vulnerability represents a residual flaw following a partial remediation attempt for CVE-2026-40189.\n\n## TL;DR\nUnauthenticated network attackers can completely bypass directory-level basic authentication and file blocklists in goshs by requesting protected files via the ?bulk ZIP-download route. This flaw is resolved in version 2.1.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-863\n- **Attack Vector**: Network\n- **CVSS Base Score**: 7.5 (High)\n- **EPSS Score**: 0.00% (Insufficient telemetry data)\n- **Impact**: Unauthenticated arbitrary file read under the server's webroot\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs (goshs-labs)\n- **goshs**: < 2.1.1 (Fixed in: `v2.1.1`)\n\n## Mitigation\n\n- Upgrade goshs to version 2.1.1 or newer\n- Apply global basic authentication via the server's command-line configuration arguments (-b)\n- Block bulk-download query parameters using a reverse proxy or Web Application Firewall (WAF)\n\n**Remediation Steps:**\n1. Audit all deployed goshs systems to identify instances running versions prior to 2.1.1\n2. Download and compile goshs version 2.1.1 or pull the updated release binary from the official repository\n3. If updating cannot be completed immediately, modify reverse proxy configurations to intercept and drop HTTP requests containing the '?bulk' query parameter\n4. Deploy global basic authentication configuration keys to ensure all requests undergo centralized validation before routing\n\n## References\n\n- [GHSA-rmxw-pq4x-3fvh: ACL authorization bypass via ?bulk](https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh)\n- [Fix Commit: Add ACL/Blocklist verification to bulkDownload](https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d)\n- [goshs v2.1.1 Release Notes](https://github.com/goshs-labs/goshs/releases/tag/v2.1.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54719) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T00:00:29.211206Z"} {"uuid": "8c82b4f1-e43e-4085-b171-1e6aa21d6cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54719", "type": "seen", "source": "https://gist.github.com/alon710/9b8006195456ffdcd967a102fe0db5d4", "content": "# CVE-2026-54719: CVE-2026-54719: Access Control List Authorization Bypass in goshs via bulk ZIP Download Route\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54719\n\n## Summary\nCVE-2026-54719 is a high-severity Access Control List (ACL) authorization bypass vulnerability in goshs, a lightweight HTTPS-capable server used for file sharing. The issue allows unauthenticated network attackers to completely bypass file-level and directory-level authentication mechanisms and blocklists by requesting protected resources via the bulk ZIP-download route (?bulk). This vulnerability represents a residual flaw following a partial remediation attempt for CVE-2026-40189.\n\n## TL;DR\nUnauthenticated network attackers can completely bypass directory-level basic authentication and file blocklists in goshs by requesting protected files via the ?bulk ZIP-download route. This flaw is resolved in version 2.1.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-863\n- **Attack Vector**: Network\n- **CVSS Base Score**: 7.5 (High)\n- **EPSS Score**: 0.00% (Insufficient telemetry data)\n- **Impact**: Unauthenticated arbitrary file read under the server's webroot\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs (goshs-labs)\n- **goshs**: < 2.1.1 (Fixed in: `v2.1.1`)\n\n## Mitigation\n\n- Upgrade goshs to version 2.1.1 or newer\n- Apply global basic authentication via the server's command-line configuration arguments (-b)\n- Block bulk-download query parameters using a reverse proxy or Web Application Firewall (WAF)\n\n**Remediation Steps:**\n1. Audit all deployed goshs systems to identify instances running versions prior to 2.1.1\n2. Download and compile goshs version 2.1.1 or pull the updated release binary from the official repository\n3. If updating cannot be completed immediately, modify reverse proxy configurations to intercept and drop HTTP requests containing the '?bulk' query parameter\n4. Deploy global basic authentication configuration keys to ensure all requests undergo centralized validation before routing\n\n## References\n\n- [GHSA-rmxw-pq4x-3fvh: ACL authorization bypass via ?bulk](https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh)\n- [Fix Commit: Add ACL/Blocklist verification to bulkDownload](https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d)\n- [goshs v2.1.1 Release Notes](https://github.com/goshs-labs/goshs/releases/tag/v2.1.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54719) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T00:00:29.211206Z"} https://vulnerability.circl.lu/sighting/8c82b4f1-e43e-4085-b171-1e6aa21d6cfa/export Wed, 29 Jul 2026 00:00:29 +0000 https://vulnerability.circl.lu/sighting/9528a3fa-caf2-4d6a-9d3e-a2c4a8ea25a3/export {"uuid": "9528a3fa-caf2-4d6a-9d3e-a2c4a8ea25a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54719", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh", "content": "", "creation_timestamp": "2026-07-28T22:35:03.730787Z"} {"uuid": "9528a3fa-caf2-4d6a-9d3e-a2c4a8ea25a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54719", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh", "content": "", "creation_timestamp": "2026-07-28T22:35:03.730787Z"} https://vulnerability.circl.lu/sighting/9528a3fa-caf2-4d6a-9d3e-a2c4a8ea25a3/export Tue, 28 Jul 2026 22:35:03 +0000 https://vulnerability.circl.lu/sighting/a5403097-2c2d-4b97-bf9c-814f8a2463c6/export {"uuid": "a5403097-2c2d-4b97-bf9c-814f8a2463c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54719", "type": "seen", "source": "https://gist.github.com/alon710/9b8006195456ffdcd967a102fe0db5d4", "content": "# CVE-2026-54719: CVE-2026-54719: Access Control List Authorization Bypass in goshs via bulk ZIP Download Route\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54719\n\n## Summary\nCVE-2026-54719 is a high-severity Access Control List (ACL) authorization bypass vulnerability in goshs, a lightweight HTTPS-capable server used for file sharing. The issue allows unauthenticated network attackers to completely bypass file-level and directory-level authentication mechanisms and blocklists by requesting protected resources via the bulk ZIP-download route (?bulk). This vulnerability represents a residual flaw following a partial remediation attempt for CVE-2026-40189.\n\n## TL;DR\nUnauthenticated network attackers can completely bypass directory-level basic authentication and file blocklists in goshs by requesting protected files via the ?bulk ZIP-download route. This flaw is resolved in version 2.1.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-863\n- **Attack Vector**: Network\n- **CVSS Base Score**: 7.5 (High)\n- **EPSS Score**: 0.00% (Insufficient telemetry data)\n- **Impact**: Unauthenticated arbitrary file read under the server's webroot\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs (goshs-labs)\n- **goshs**: < 2.1.1 (Fixed in: `v2.1.1`)\n\n## Mitigation\n\n- Upgrade goshs to version 2.1.1 or newer\n- Apply global basic authentication via the server's command-line configuration arguments (-b)\n- Block bulk-download query parameters using a reverse proxy or Web Application Firewall (WAF)\n\n**Remediation Steps:**\n1. Audit all deployed goshs systems to identify instances running versions prior to 2.1.1\n2. Download and compile goshs version 2.1.1 or pull the updated release binary from the official repository\n3. If updating cannot be completed immediately, modify reverse proxy configurations to intercept and drop HTTP requests containing the '?bulk' query parameter\n4. Deploy global basic authentication configuration keys to ensure all requests undergo centralized validation before routing\n\n## References\n\n- [GHSA-rmxw-pq4x-3fvh: ACL authorization bypass via ?bulk](https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh)\n- [Fix Commit: Add ACL/Blocklist verification to bulkDownload](https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d)\n- [goshs v2.1.1 Release Notes](https://github.com/goshs-labs/goshs/releases/tag/v2.1.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54719) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T22:30:56.630790Z"} {"uuid": "a5403097-2c2d-4b97-bf9c-814f8a2463c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54719", "type": "seen", "source": "https://gist.github.com/alon710/9b8006195456ffdcd967a102fe0db5d4", "content": "# CVE-2026-54719: CVE-2026-54719: Access Control List Authorization Bypass in goshs via bulk ZIP Download Route\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54719\n\n## Summary\nCVE-2026-54719 is a high-severity Access Control List (ACL) authorization bypass vulnerability in goshs, a lightweight HTTPS-capable server used for file sharing. The issue allows unauthenticated network attackers to completely bypass file-level and directory-level authentication mechanisms and blocklists by requesting protected resources via the bulk ZIP-download route (?bulk). This vulnerability represents a residual flaw following a partial remediation attempt for CVE-2026-40189.\n\n## TL;DR\nUnauthenticated network attackers can completely bypass directory-level basic authentication and file blocklists in goshs by requesting protected files via the ?bulk ZIP-download route. This flaw is resolved in version 2.1.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-863\n- **Attack Vector**: Network\n- **CVSS Base Score**: 7.5 (High)\n- **EPSS Score**: 0.00% (Insufficient telemetry data)\n- **Impact**: Unauthenticated arbitrary file read under the server's webroot\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs (goshs-labs)\n- **goshs**: < 2.1.1 (Fixed in: `v2.1.1`)\n\n## Mitigation\n\n- Upgrade goshs to version 2.1.1 or newer\n- Apply global basic authentication via the server's command-line configuration arguments (-b)\n- Block bulk-download query parameters using a reverse proxy or Web Application Firewall (WAF)\n\n**Remediation Steps:**\n1. Audit all deployed goshs systems to identify instances running versions prior to 2.1.1\n2. Download and compile goshs version 2.1.1 or pull the updated release binary from the official repository\n3. If updating cannot be completed immediately, modify reverse proxy configurations to intercept and drop HTTP requests containing the '?bulk' query parameter\n4. Deploy global basic authentication configuration keys to ensure all requests undergo centralized validation before routing\n\n## References\n\n- [GHSA-rmxw-pq4x-3fvh: ACL authorization bypass via ?bulk](https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh)\n- [Fix Commit: Add ACL/Blocklist verification to bulkDownload](https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d)\n- [goshs v2.1.1 Release Notes](https://github.com/goshs-labs/goshs/releases/tag/v2.1.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54719) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T22:30:56.630790Z"} https://vulnerability.circl.lu/sighting/a5403097-2c2d-4b97-bf9c-814f8a2463c6/export Tue, 28 Jul 2026 22:30:56 +0000