📄 Caddy 2.10.0 Server-Side Request Forgery

Caddy version 2.10.0 suffers from a server-side request forgery vulnerability via a JSON configuration injection. Exploit Title: Caddy 2.10.0 - Admin API SSRF via JSON Config Injection Date: 2025-07-10 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://caddyserver.com/ Software Link:...

GHSA-VRW8-FXC6-2R93 vulnerabilities

Vulnerabilities for packages: tkn, gitness, buf, karma, kyverno-policy-reporter-ui, step-issuer, step, caddy, cloudflared, rclone, gogatekeeper, step-ca, sftpgo...

Fedora 43 : caddy (2025-89401f2116)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-89401f2116 advisory. Update to version 2.10.0. Aside from the new upstream features, this update also refreshes many bundled dependencies, fixing a few CVEs...

Fedora 42 : caddy (2025-4518c12e2f)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4518c12e2f advisory. Update to version 2.10.0. Aside from the new upstream features, this update also refreshes many bundled dependencies, fixing a few CVEs...

Fedora: Security Advisory (FEDORA-2025-4518c12e2f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-21493

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead ...

CVE-2024-21496

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

[SECURITY] Fedora 42 Update: caddy-2.10.0-1.fc42

Caddy is an extensible server platform that uses TLS by default...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: prometheus, opentelemetry-collector, spqr, crossplane-provider-keycloak, libnvidia-container, flannel-cni-plugin, velero-plugin-for-aws, cargobump, crossplane-provider-sql, dex, kbld, docker-credential-ecr-login, terraform-provider-time, nri-memcached, tw,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: prometheus, opentelemetry-collector, spqr, crossplane-provider-keycloak, libnvidia-container, flannel-cni-plugin, velero-plugin-for-aws, cargobump, crossplane-provider-sql, dex, kbld, docker-credential-ecr-login, terraform-provider-time, nri-memcached, tw,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: kubecolor, flux, crossplane-provider-azure-authorization, kubernetes-csi-external-resizer, flux-source-controller-fips, k3d, nri-postgresql, tailscale, prometheus-postgres-exporter, victoriametrics-fips, amazon-cloudwatch-agent-operator, mkcert,...

openSUSE Security Advisory (openSUSE-SU-2024:0220-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-45339 vulnerabilities

Vulnerabilities for packages: portieris-fips, sriov-network-device-plugin-fips, flux-image-reflector-controller-fips, sriov-network-device-plugin, step, smarter-device-manager-fips, portieris, nfs-subdir-external-provisioner, pulumi, caddy, skaffold, flux-image-reflector-controller, opa-fips-envo...

GHSA-PX8V-PP82-RCVR vulnerabilities

Vulnerabilities for packages: q, cloudflared, kubernetes-dns-node-cache, kubernetes-dns-node-cache-fips, caddy-fips, eks-distro, k3s, spegel, traefik, buf, eks-distro-fips, frp, traefik-fips, caddy...

GHSA-PX8V-PP82-RCVR vulnerabilities

Vulnerabilities for packages: k3s, buf, spegel, kubernetes-dns-node-cache, q, caddy, cloudflared, frp...

CVE-2024-53259 vulnerabilities

Vulnerabilities for packages: q, cloudflared, kubernetes-dns-node-cache, kubernetes-dns-node-cache-fips, caddy-fips, eks-distro, k3s, spegel, traefik, buf, eks-distro-fips, frp, traefik-fips, caddy...

CVE-2024-53259 vulnerabilities

Vulnerabilities for packages: k3s, buf, spegel, kubernetes-dns-node-cache, q, caddy, cloudflared, frp...

Fedora 41 : caddy (2024-bd8fe42929)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bd8fe42929 advisory. Automatic update for caddy-2.8.4-1.fc41. Changelog Fri Jul 5 2024 Carl George - 2.8.4-1 - Update to version 2.8.4 rhbz2278549 - Resolves...

Fedora: Security Advisory (FEDORA-2024-19d093c14d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2023-57b1499122)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...