GO
Product
gophish
7
CVEs
0
On KEV
8.1
Max CVSS
5
New 30D
Severity mix
Critical 0High 2Medium 4Low 1
Watch
Add gophish to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-82269 | 8.1 | Aug 28 | Gophish Account Lockout and Forced Password Change Bypassable via API Key Affected: through 0.12.1 |
| CVE-2026-107270 | 7.1 | Oct 7 | Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints Affected: through 0.12.1 |
| CVE-2026-39904 | 6.5 | Jun 22 | Gophish 0.12.1 Denial of Service via Office Document Upload Affected: through 0.12.1 |
| CVE-2026-107271 | 5.3 | Oct 7 | Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing Affected: through 0.12.1 |
| CVE-2026-107272 | 4.7 | Oct 7 | Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages Affected: through 0.12.1 |
| CVE-2026-107273 | 4.3 | Oct 7 | Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site Affected: 0.11.0 through 0.12.1 |
| CVE-2026-107269 | 3.7 | Oct 7 | Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy Affected: through 0.12.1 |
Showing 7