Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-75601 | Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled | * | 4.3 | — | 2026-08-27 | |
| CVE-2026-27480 | Static Web Server: Timing-Based Username Enumeration in Basic Authentication | * | 5.3 | — | 2026-02-21 | |
| CVE-2025-67487 | Static Web Server is vulnerable to symbolic link Path Traversal | * | 5.5 | — | 2025-12-09 | |
| CVE-2024-32966 | Stored Cross-site Scripting in directory listings via file names in static-web-server | * | 5.8 | — | 2024-05-01 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).