Caddy security vulnerabilities
Open-source infrastructure. Public CVE monitoring for Caddy. Vendor security advisories are linked on this page.
Built for Operators of this product.
19 public records · 0 security-fix timeline events. 0 published in the last 7 days. 17 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 1
2026-08-041 issues2026-11-01
Known exploited
View all known exploitedRecently published
Browse catalog- Medium6.5Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.49%Sep 17, 2026
- MediumConnection created for the wrong upstream for forward_auth + reverse_proxyOpen the advisoryJul 10, 2026
- High8.1Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.45%Jun 8, 2026
- High7.5Windows path authorization bypass via encoded backslashCheck if you run itEPSS 0.62%Jun 8, 2026
- Medium4.2Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.25%Jun 8, 2026
- Medium4.3Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path MatchingOpen the advisoryMay 13, 2026
- Medium5.4Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.24%May 13, 2026
- HighUnsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesCheck if you run itEPSS 0.68%May 13, 2026
- Medium5.5Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.44%Mar 6, 2026
- High8.8Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.26%Mar 6, 2026