Comparison Overview
Forever 21
Forever 21
3880 Mission Road, Los Angeles, 90031, US
Last Update: 02/04/2026
Forever 21 continues to be a fashion industry leader with a mission to make the latest trends accessible to all. F21 persists on staying ahead of innovation and providing styles and fit that our customers love. While reinventing for now and beyond, we’re seeking passion...
Tapestry
10 Hudson Yards, New York, New York, US, 10001
Last Update: 17/07/2026
Our global house of brands unites the magic of Coach and Kate Spade New York. By intertwining different people and ideas, we push ourselves in our work and expand the bounds of possibility. Learn about our iconic brands: tapestry.com/our-brands We’ve grown by finding p...
Compliance Ranges Comparison
Forever 21
Tapestry
Benchmark & Cyber Underwriting Signals
Incidents vs Retail Apparel and Fashion Industry Avg (This Year)
No incidents recorded for Forever 21 in 2026.
Incidents vs Retail Apparel and Fashion Industry Avg (This Year)
No incidents recorded for Tapestry in 2026.
Incident History - Forever 21 (X = Date, Y = Severity)
Forever 21 cyber incidents detection timeline including parent company and subsidiaries.
Incident History - Tapestry (X = Date, Y = Severity)
Tapestry cyber incidents detection timeline including parent company and subsidiaries.
Notable Incidents
Forever 21
Tapestry
FAQ
Latest Global CVEs
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName() on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This issue is fixed in version 2.1.5.
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.