Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-15913

Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Mft
CVE-2026-0972

HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-14362

GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-1241

Encryption vulnerable to brute-force decryption in GoAnywhere MFT

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Fortra Linux and 1 more
Products
Macos Goanywhere Agents Goanywhere Managed File Transfer and 3 more
CVE-2026-0971

GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2026-1089

User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft