GO-2026-5030 vulnerabilities

Vulnerabilities for packages: minio, telegraf, step-issuer, prometheus-operator, fq, kyverno, kubernetes, hubble, hydra, caddy, cilium, glab, nerdctl, terraform-provider-acme, step, ingress-nginx-controller, karpenter, snyk-cli, kots, opentelemetry-collector, helm, k3s,...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step, caddy, step-ca, step-issuer...

GO-2025-4181 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step, caddy, step-ca, step-issuer...

GO-2024-2459 vulnerabilities

Vulnerabilities for packages: caddy, frp...

GO-2024-2682 vulnerabilities

Vulnerabilities for packages: cloudflared, caddy, q, k3s...

GO-2026-5028 vulnerabilities

Vulnerabilities for packages: minio, telegraf, step-issuer, prometheus-operator, fq, kyverno, kubernetes, hubble, hydra, caddy, cilium, glab, nerdctl, terraform-provider-acme, step, ingress-nginx-controller, karpenter, snyk-cli, kots, opentelemetry-collector, helm, k3s,...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: caddy, sftpgo, buf, step, tkn, step-issuer, gogatekeeper, kyverno-policy-reporter-ui, step-ca, gitness, rclone, cloudflared, karma...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: caddy, k8sgateway, ipfs-cluster, buf, q, spegel, traefik, frp, seaweedfs, kubo, dkron, kubernetes-dns-node-cache, kargo, k3s...

GO-2024-3302 vulnerabilities

Vulnerabilities for packages: caddy, buf, q, frp, kubernetes-dns-node-cache, spegel, cloudflared, k3s...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: caddy, step, trillian, kots, step-ca, argo-workflows...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: temporal-server, caddy, spicedb, step, src, trillian, step-ca, kine, kots, kube-bench, amass, argo-workflows, ferretdb, k3s...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, pulumi-kubernetes-operator, minio, docker-machine-driver-linode, crossplane-provider-aws-route53, gitlab-kas, step-issuer, flux-image-automation-controller, terraform-provider-acme, sops, terraform-provider-azurerm,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, opa, pluto, cis-operator, aws-privateca-issuer, grafana-rollout-operator, ini-file, argo-events, kor, gobuster, timescaledb-tune, nri-apache, clickhouse-operator, guac, dive, emissary, ko, grafana-alloy, terraform-provider-azapi, spire-controller-manage...

SUSE CVE-2026-45692

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different...

SUSE CVE-2026-46415

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...

GO-2026-5492 Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy...

GO-2026-5730 Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy

Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: caddy: caddy-2.11.4-0.3.hum1 aarch64, x8664 caddy-2.11.4-0.3.hum1.src src Security Fixes: caddy: CVE-2026-56852...

CVE-2026-46415

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used r.RemoteAddr when evaluating whether a request should be blocked. RemoteAddr is the address of the immediate peer...