Caddy

United States Open Source caddyserver.com ↗

RISKY

Total CVEs

Crit / High

Medium

50%

Unpatched

Patched

8.1

Avg CVSS

CISA KEV

// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →

// INTEL UPGRADE

Full Company Dossier — Coming Soon

Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.

OSINT FINANCIALS EXEC PROFILES BREACH DB

▸ CVE Trend by Year

▸ Patch Coverage

Patched

Unpatched

50%

Under Review

50%

✓ 0 patched ✗ 2 unpatched ~ 2 under review

▸ Intelligence by Audience

PoC Available

1 / 20 shown

CISA KEV (Exploited)

Shodan Dorks

ssl:"caddy" port:443

org:"Caddy" http.status:200

Top EPSS (Exploitation Probability)

CVE-2022-28923 1.43% exploitation probability

CVE-2026-77281 0.49% exploitation probability

CVE-2026-92700 0.41% exploitation probability

CVE-2026-92284 0.39% exploitation probability

Quick Facts for Reporting

Total CVEs tracked

Critical severity

Actively exploited (CISA)

Unpatched ratio

50%

Avg CVSS score

8.1

Security grade

D (RISKY)

NVD Data Attribution

Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-06-15

Security Risk Score (for investors)

LOW

Vuln Volume

AVG

Patch Responsiveness

LOW

CISA Exposure

⚠ Not financial advice. Past security incidents do not guarantee future stock performance.

▸ Security News Google News

Women in Cybersecurity - Department of Energy (.gov)

Department of Energy (.gov) 2026-09-24

Critical SolarWinds Flaw Lets Attackers Bypass Web Help Desk SAML Login - CyberSecurityNews

CyberSecurityNews 2026-07-30

HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare Pingora - CyberSecurityNews

CyberSecurityNews 2026-06-03

Open source to open door: Software emerges as risk to the grid - E&E News by POLITICO

E&E News by POLITICO 2022-10-14

Hundreds of Exposed Clawdbot Gateways Leave API Keys and Private Chats Vulnerable - CyberSecurityNews

CyberSecurityNews 2026-01-26

▸ Recent CVEs showing 20 of 4

CVE ID	Severity	Patch	EPSS	Date
CVE-2026-92284	7.5 HIGH	UNKNOWN / UNPATCHED	0.39%	2026-09-23
CVE-2026-92700	5.3 MEDIUM	UNKNOWN / UNPATCHED	0.41%	2026-09-23
CVE-2026-77281	6.5 MEDIUM	PATCH UNDER REVIEW	0.49%	2026-09-17
CVE-2022-28923 PoC	? N/A	PATCH UNDER REVIEW	1.43%	2023-02-06

View all 4 CVEs for Caddy →

▸Intel

Founded2015

CountryUnited States

LicenseOpen Source

Trust ScoreD — RISKY

Max CVSS8.1

Last Updated2026-06-15

▸Top Weaknesses

▸Company Profile

Caddy is an open-source web server written in Go, known for its automatic HTTPS and ease of use. It is significant in cybersecurity for its default encryption and modern security features, reducing configuration errors that often lead to vulnerabilities. The project is maintained by the community and its creator, with a small number of tracked CVEs reflecting its security-focused design.

▸Response Metrics

Est. MTTR ⓘ ~500 days (Critical)

Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)

CVE Trend ⓘ ↗ +700% worse

CVE count 2026 vs 2023: 1 → 8 CVEs

Patch Speed ⓘ Poor (>65% open)

50% of CVEs still unpatched. Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%

▸ Financial Risk Estimate

Est. GDPR Low

€600K

Est. GDPR High

€6.0M

Based on 0 critical CVEs, 0 CISA KEV, 100% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions

⚖ Compare with another vendor

▸Embed Badge

Caddy D valtersit.com