Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the splitPos function. An attacker can cause unintended script execution by crafting a request path containing specific multi-byte Unicode characters, which manipulates the...

PT-2026-7893

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2025.10.4 authentik versions prior to 2025.12.4 Description authentik is an open-source identity provider. A malformed cookie could bypass authentication when using forward authentication with the authentik Proxy...

CVE-2023-50463

The caddy-geo-ip aka GeoIP middleware through 0.6.0 for Caddy 2, when trustheader X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictio...

CVE-2023-49854

Cross-Site Request Forgery CSRF vulnerability in Tribe Interactive Caddy – Smart Side Cart for WooCommerce.This issue affects Caddy – Smart Side Cart for WooCommerce: from n/a through 1.9.7...

CVE-2023-45084

An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity. This issue...

PT-2026-21767

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description The path sanitization routine in Caddy's file matcher does not properly sanitize backslashes, potentially allowing bypass of path-related security protections. This issue affects users with specific...

PT-2026-21772

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description Caddy’s HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences %xx it compares against the request's escaped path without lowercasin...

PT-2026-21773

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description Caddy’s HTTP host request matcher is documented as case-insensitive, but becomes case-sensitive when configured with a large host list more than 100 entries due to an optimized matching path. An...

PT-2026-21774

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.1 Description The local Caddy admin API, listening by default on 127.0.0.1:2019, includes a POST /load endpoint that allows replacing the entire running configuration. When origin enforcement is not enabled enforce...

CVE-2025-64702 vulnerabilities

Vulnerabilities for packages: seaweedfs-fips, k8sgateway-fips, kubernetes-dns-node-cache, k8sgateway, ipfs-cluster-fips, spegel-fips, caddy, q, ipfs-cluster, spegel, k3s, dkron-fips, eks-distro-fips, kargo, kubo-fips, syncthing, kubernetes-dns-node-cache-fips, caddy-fips, traefik, rke2-runtime,...

GHSA-G754-HX8W-X2G6 vulnerabilities

Vulnerabilities for packages: seaweedfs-fips, k8sgateway-fips, kubernetes-dns-node-cache, k8sgateway, ipfs-cluster-fips, spegel-fips, caddy, q, ipfs-cluster, spegel, k3s, dkron-fips, eks-distro-fips, kargo, kubo-fips, syncthing, kubernetes-dns-node-cache-fips, caddy-fips, traefik, rke2-runtime,...

CVE-2025-44005 vulnerabilities

Vulnerabilities for packages: caddy...

GHSA-H8CP-697H-8C8P vulnerabilities

Vulnerabilities for packages: caddy...

GHSA-J7C9-79X7-8HPR vulnerabilities

Vulnerabilities for packages: caddy...

CVE-2025-66406 vulnerabilities

Vulnerabilities for packages: caddy...

GHSA-J7C9-79X7-8HPR vulnerabilities

Vulnerabilities for packages: caddy-fips, caddy...

CVE-2025-66406 vulnerabilities

Vulnerabilities for packages: caddy-fips, caddy...

GHSA-H8CP-697H-8C8P vulnerabilities

Vulnerabilities for packages: caddy-fips, caddy...

CVE-2025-44005 vulnerabilities

Vulnerabilities for packages: caddy-fips, caddy...

Fedora: Security Advisory (FEDORA-2025-89401f2116)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...