CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product fortra:goanywhere_managed_file_transfer. Show all products

8 CVEs, showing 1 to 8
CVESeverityTitlePublished
CVE-2026-1089Medium 6.5User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.Apr 21, 2026
CVE-2026-0972Medium 5.4HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.Apr 21, 2026
CVE-2026-0971Medium 4.3An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.Apr 21, 2026
CVE-2025-1241Medium 4.9Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.Apr 21, 2026
CVE-2025-14362High 7.3The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH ke…Apr 21, 2026
CVE-2025-8148Medium 4.2An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authenticati…Dec 5, 2025
CVE-2025-10035
Known exploited
Critical 10.0Deserialization Vulnerability in GoAnywhere MFT's License Servlet
Assigned by Fortra
Sep 18, 2025
CVE-2023-0669
Known exploited
High 7.2Fortra GoAnywhere MFT License Response Servlet Command Injection
Assigned by rapid7
Feb 6, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.