GO-2025-4180 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: buildkitd, kubernetes, kubevela, prometheus-adapter, up, caddy, k3s...

GO-2025-4181 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: caddy, step, step-ca, step-issuer...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: caddy, step, step-ca, step-issuer...

GO-2024-2459 vulnerabilities

Vulnerabilities for packages: caddy, frp...

GO-2026-5030 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, external-secrets-operator, zot, telegraf, grafana-pyroscope, minio, gptscript, caddy, mattermost, istio, kots, kyverno, gitea, crossplane-provider-azure-authorization, kubernetes, glab, opentelemetry-collector, vale, hydra, prometheus,...

GO-2026-5028 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, external-secrets-operator, zot, telegraf, grafana-pyroscope, minio, gptscript, caddy, mattermost, istio, kots, kyverno, gitea, crossplane-provider-azure-authorization, kubernetes, glab, opentelemetry-collector, vale, hydra, prometheus,...

GO-2024-2682 vulnerabilities

Vulnerabilities for packages: caddy, cloudflared, q, k3s...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: sftpgo, step-ca, tkn, cloudflared, gogatekeeper, step, kyverno-policy-reporter-ui, buf, rclone, karma, step-issuer, caddy, gitness...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: dkron, kubernetes-dns-node-cache, kubo, ipfs-cluster, k8sgateway, spegel, frp, seaweedfs, traefik, kargo, q, buf, caddy, k3s...

GO-2024-3302 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, cloudflared, spegel, frp, q, buf, caddy, k3s...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: step-ca, argo-workflows, step, trillian, caddy, kots...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: step-ca, argo-workflows, kine, amass, step, spicedb, trillian, ferretdb, temporal-server, kube-bench, caddy, kots, src, k3s...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: tw, crossplane-provider-aws-kms, crossplane-provider-aws-rds, gomplate, crossplane-provider-aws-sqs, docker-compose, crossplane-provider-aws-eks, gptscript, melange, trivy, openbao, istio, src, terraform-provider-azapi, gitlab-runner, gitea,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: helm-set-status, chartmuseum, gptscript, trivy, harbor-registry, wgcf, src, terraform-provider-azapi, cloud-sql-proxy, k8sgpt, thanos-operator, kor, kapp, fulcio, rancher-system-agent, headlamp, aactl, prometheus, kubernetes-csi-driver-hostpath, hubble, cerbos,...

[SECURITY] [DSA 6429-1] caddy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/security/ Aron Xu August 11, 2026 https://www.debian.org/security/faq -...

SUSE CVE-2026-45135

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct fla...

SUSE CVE-2026-52844

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but fileserver later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy...