Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Patrickhener
Goshs

patrickhener goshs Vulnerabilities: CVEs, CISA KEV & Security Advisories

13 CVEs

patrickhener goshs Vulnerabilities

CVE security advisories and vulnerability history for goshs by patrickhener.

13

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

12

Public exploits

With known exploit

8.6

Avg CVSS

2025–2026

Last updated May 4, 2026

Overview

patrickhener goshs has 13 published CVE records since 2025, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 12 have a known public exploit. The average CVSS base score across scored CVEs is 8.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting patrickhener goshs, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of patrickhener goshs's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical7

High4

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of patrickhener goshs's CVEs are currently listed in CISA's KEV catalog.

Public exploits

12

12 of patrickhener goshs's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every patrickhener goshs version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

v0.3.41 CVE
v0.3.51 CVE
v0.3.61 CVE
v0.3.71 CVE
v0.3.81 CVE
v0.3.91 CVE
v0.4.01 CVE
v0.4.11 CVE
v0.4.21 CVE
v1.0.01 CVE
v1.0.11 CVE
v1.0.21 CVE
v1.0.31 CVE
v1.0.41 CVE

Fixed in

1eb190b81f7a7d8bbb94387c3d192a0dfa420e871 CVE

Find a version

13 CVEs

Sort

goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
CVE-2026-42091
Public exploit
Patch
CWE-352
Medium · CVSS 6.5
EPSS 0.0% (4th pct)2026-05-04
Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence
CVE-2026-40903
Patch
CWE-829
Critical · CVSS 9.1
EPSS 0.0% (15th pct)2026-04-21
goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
CVE-2026-40885
Public exploit
Patch
CWE-200
High · CVSS 7.7
EPSS 0.1% (26th pct)2026-04-21
goshs: Empty-username SFTP password authentication bypass in goshs
CVE-2026-40884
Public exploit
Patch
CWE-306
Critical · CVSS 9.8
EPSS 0.1% (27th pct)2026-04-21
goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
CVE-2026-40883
Public exploit
Patch
CWE-352
Medium · CVSS 6.1
EPSS 0.0% (7th pct)2026-04-21
SFTP root escape via prefix-based path validation in goshs
CVE-2026-40876
Public exploit
Patch
CWE-22
High · CVSS 8.7
EPSS 0.1% (19th pct)2026-04-21
goshs has a file-based ACL authorization bypass in goshs state-changing routes
CVE-2026-40189
Public exploit
Patch
CWE-862
Critical · CVSS 9.3
EPSS 0.1% (16th pct)2026-04-10
goshs is Missing Write Protection for Parametric Data Values
CVE-2026-40188
Public exploit
Patch
CWE-1314
High · CVSS 7.7
EPSS 0.0% (2th pct)2026-04-10
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
CVE-2026-35471
Public exploit
Patch
CWE-22
Critical · CVSS 9.8
EPSS 0.1% (18th pct)2026-04-06
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
CVE-2026-35393
Public exploit
Patch
CWE-22
Critical · CVSS 9.8
EPSS 0.1% (18th pct)2026-04-06
goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
CVE-2026-35392
Public exploit
Patch
CWE-22
Critical · CVSS 9.8
EPSS 0.1% (18th pct)2026-04-06
goshs has Auth Bypass via Share Token
CVE-2026-34581
Public exploit
Patch
CWE-288
High · CVSS 8.1
EPSS 0.0% (14th pct)2026-04-02
goshs route not protected, allows command execution
CVE-2025-46816
Public exploit
Patch
CWE-284
Critical · CVSS 9.4
EPSS 0.2% (36th pct)2025-05-06

Common weakness types

The CWE weakness categories most often found in patrickhener goshs CVEs. Follow any weakness for its full explanation.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs
CWE-284Improper Access Control1 CVE
CWE-288Authentication Bypass Using an Alternate Path or Channel1 CVE
CWE-306Missing Authentication for Critical Function1 CVE
CWE-829Inclusion of Functionality from Untrusted Control Sphere1 CVE
CWE-1314Missing Write Protection for Parametric Data Values1 CVE
CWE-862Missing Authorization1 CVE

Disclosure activity by year

How many patrickhener goshs CVEs were published each year.

2025

1

2026

12

Other patrickhener products

Browse vulnerabilities for other products by patrickhener.

github.com/patrickhener/goshs10 CVEs github.com/patrickhener/goshs/v25 CVEs

All patrickhener vulnerabilities

Frequently asked questions

Common questions about patrickhener goshs vulnerabilities.

How many CVEs does patrickhener goshs have?

patrickhener goshs has 13 published CVE records since 2025.

How many patrickhener goshs CVEs are in CISA KEV?

None of patrickhener goshs's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for patrickhener goshs vulnerabilities?

Yes — 12 of patrickhener goshs's CVEs have a known public exploit.

Which versions of patrickhener goshs are affected?

15 distinct patrickhener goshs versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in patrickhener goshs CVEs?

patrickhener goshs's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-284 (Improper Access Control), CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

How many critical patrickhener goshs vulnerabilities are there?

patrickhener goshs has 7 critical and 4 high-severity CVEs.

What is the average severity of patrickhener goshs CVEs?

The average CVSS base score across patrickhener goshs's scored CVEs is 8.6.

References

All patrickhener vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track patrickhener goshs vulnerabilities

Monitor new patrickhener goshs vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References