Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-21 | 1 | Disclosure1 |
| 2026-05-12 | 2 | Disclosure1General1 |
Unpopular opinion: The cybersecurity industry is selling you dashboards. CVE: CVE-2026-40903 CVSS: 9.1 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The text announces a critical vulnerability (CVE-2026-40903) with its CVSS rating and severity, but provides no PoC, exploit, or remediation details.
https://lyrie.ai/research/research/cve-2026-40903-goshs-goshs #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The provided text consists only of a reference link and hashtags, offering no concrete information about the vulnerability or its exploitation state.
CVE-2026-40903 ArtiPACKED Vulnerability in goshs SimpleHTTPServer Prior to 2.0.0-beta.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40903
Post summary
The post announces CVE-2026-40903, identifying a vulnerability in goshs SimpleHTTPServer before version 2.0.0-beta.6 and provides a link for further details.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | goshs | goshs | - | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |