goshs

• CVE-2026-40884 - goshs empty-username SFTP authentication bypass 2026-05-03
• CVE-2026-40903 - goshs ArtiPACKED GitHub Actions token leakage 2026-05-03