CVE-2026-40883 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because...

CVE-2026-40883 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because...

GHSA-W253-42QP-5F2X

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:26+00:00| seen| Telegram/raJRCian8jdwHZHMkV6wtcQApYY70x43uMZTCVVg-5BoqY...

CVE-2026-40599

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:26+00:00| seen| Telegram/raJRCian8jdwHZHMkV6wtcQApYY70x43uMZTCVVg-5BoqY...

GHSA-QQX8-2XMM-JRV8

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:26+00:00| seen| Telegram/raJRCian8jdwHZHMkV6wtcQApYY70x43uMZTCVVg-5BoqY...

CVE-2026-5652

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:03+00:00| seen| Telegram/5jFlrKy1YlFFC2zo3JzgQk5Ry2crUJcwyAKkfj888Y7MPt0 2026-05-31 12:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn5jpf7oo62w...

GHSA-4H5P-7F5C-Q7GJ

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:03+00:00| seen| Telegram/5jFlrKy1YlFFC2zo3JzgQk5Ry2crUJcwyAKkfj888Y7MPt0...

GHSA-9FF4-MMHV-X6JP

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:03+00:00| seen| Telegram/5jFlrKy1YlFFC2zo3JzgQk5Ry2crUJcwyAKkfj888Y7MPt0...

GHSA-WPV9-C2GV-2J82

creationtimestamp| type| source ---|---|--- 2026-04-21 19:26:03+00:00| seen| Telegram/5jFlrKy1YlFFC2zo3JzgQk5Ry2crUJcwyAKkfj888Y7MPt0...

CVE-2026-24177

creationtimestamp| type| source ---|---|--- 2026-04-21 19:25:24+00:00| seen| Telegram/IV3XUTumqBvhxDGxYKmJv890gnK1hu13PgwZ6nuJXKkSo...

CVE-2026-6754

creationtimestamp| type| source ---|---|--- 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:21+00:00| seen|...

CVE-2026-6749

creationtimestamp| type| source ---|---|--- 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:20+00:00| seen|...

CVE-2026-6746

creationtimestamp| type| source ---|---|--- 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs 2026-04-21 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260422 2026-04-22 02:01:18+00:00| seen|...

CVE-2026-23753

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFTLanguage::Create without HTML sanitization and subsequently rendered unsanitized by ViewLanguage.RenderGrid. An...

GHSA-5JW5-Q9J7-4RXC

creationtimestamp| type| source ---|---|--- 2026-04-21 17:18:19+00:00| published-proof-of-concept| Telegram/Dp3cHxEcbabtcr78eMwYzIZdIkaK3NXYlVFRQJBCFObozHI...

GHSA-4974-G27Q-H5M8

creationtimestamp| type| source ---|---|--- 2026-04-21 17:18:10+00:00| seen| Telegram/GomAqAKioRw5ORwyc6ugTkWhk08fHowYPUM-Q49l2oeUgi0...

CVE-2026-28427

creationtimestamp| type| source ---|---|--- 2026-04-21 17:18:10+00:00| seen| Telegram/GomAqAKioRw5ORwyc6ugTkWhk08fHowYPUM-Q49l2oeUgi0...

CVE-2026-3298

creationtimestamp| type| source ---|---|--- 2026-04-21 17:18:10+00:00| seen| Telegram/GomAqAKioRw5ORwyc6ugTkWhk08fHowYPUM-Q49l2oeUgi0 2026-04-22 12:50:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk3jwk3cvd2u...

CVE-2026-41190

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when APPSHOWONLYASSIGNEDCONVERSATIONS is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The savedraft AJAX path is weaker. A direct POST can create a dra...

CVE-2026-40591 FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled customerid, name, toemail, and phone values and resolves the target customer in the backend without enforcing mailbox-scoped customer visibility...