İçeriğe atla
Noroxi

caddyserver kayıtları

caddyserver üreticisine ait 20 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
1 · %5
Silahlaştırılmış
1 · %5
Pre-auth RCE
2
Düzeltme kaydı olan
%95
Yayından KEV’e ortanca
0 gün

Yıllara göre kayıt

  1. 18
  2. 20
  3. 22
  4. 23
  5. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

20 kayıt
  • CVE-2023-44487
    90Hemen

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %100

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware10 Eki 2023

  • CVE-2018-21246
    40Planlayın

    Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostM

    KritikCVSS 9,8İstismar yokEPSS %3

    caddyserver · caddy15 Haz 2020

  • CVE-2026-27590
    35İzleyin

    Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport

    YüksekCVSS 8,9İstismar yokEPSS %1

    caddyserver · caddy24 Şub 2026

  • CVE-2026-27586
    35İzleyin

    Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed

    YüksekCVSS 8,8İstismar yokEPSS %0

    caddyserver · caddy24 Şub 2026

  • CVE-2026-30851
    35İzleyin

    Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

    YüksekCVSS 8,8İstismar yokEPSS %0

    caddyserver · caddy7 Mar 2026

  • CVE-2026-45135
    32İzleyin

    Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

    YüksekCVSS 8,1İstismar yokEPSS %1

    caddyserver · caddy23 Haz 2026

  • CVE-2026-52845
    32İzleyin

    Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

    YüksekCVSS 8,1İstismar yokEPSS %0

    caddyserver · caddy23 Haz 2026

  • CVE-2022-34037
    30İzleyin

    An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of

    YüksekCVSS 7,5İstismar yokEPSS %1

    caddyserver · caddy22 Tem 2022

  • CVE-2026-52844
    30İzleyin

    Caddy: Windows `file_server` path authorization bypass via encoded backslash

    YüksekCVSS 7,5İstismar yokEPSS %1

    caddyserver · caddy23 Haz 2026

  • CVE-2026-27587
    30İzleyin

    Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass

    YüksekCVSS 7,7İstismar yokEPSS %1

    caddyserver · caddy24 Şub 2026

  • CVE-2026-27588
    30İzleyin

    Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass

    YüksekCVSS 7,7İstismar yokEPSS %1

    caddyserver · caddy24 Şub 2026

  • CVE-2026-27585
    27İzleyin

    Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections

    OrtaCVSS 6,9İstismar yokEPSS %0

    caddyserver · caddy24 Şub 2026

  • CVE-2026-27589
    27İzleyin

    Caddy vulnerable to cross-origin config application via local admin API /load (caddy)

    OrtaCVSS 6,9İstismar yokEPSS %0

    caddyserver · caddy24 Şub 2026

  • CVE-2023-50463
    26İzleyin

    The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof thei

    OrtaCVSS 6,5İstismar yokEPSS %1

    caddyserver · caddy10 Ara 2023

  • CVE-2022-28923
    24İzleyin

    Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via c

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    caddyserver · caddy6 Şub 2023

  • CVE-2022-29718
    24İzleyin

    Caddy v2.4 was discovered to contain an open redirect vulnerability.

    OrtaCVSS 6,1İstismar yokEPSS %1

    caddyserver · caddy2 Haz 2022

  • CVE-2026-30852
    22İzleyin

    Caddy: vars_regexp double-expands user input, leaking env vars and files

    OrtaCVSS 5,5İstismar yokEPSS %0

    caddyserver · caddy7 Mar 2026

  • CVE-2026-52846
    16İzleyin

    Caddy: stripHTML template function bypass

    OrtaCVSS 4,2İstismar yokEPSS %0

    caddyserver · caddy23 Haz 2026

  • CVE-2026-45692
    15İzleyin

    Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

    DüşükCVSS 3,8İstismar yokEPSS %0

    caddyserver · caddy23 Haz 2026

  • CVE-2018-19148
    14İzleyin

    Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames.

    DüşükCVSS 3,7İstismar yokEPSS %1

    caddyserver · caddy10 Kas 2018