已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-75601 | Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled | * | 4.3 | — | 2026-08-27 | |
| CVE-2026-27480 | Static Web Server: Timing-Based Username Enumeration in Basic Authentication | * | 5.3 | — | 2026-02-21 | |
| CVE-2025-67487 | Static Web Server is vulnerable to symbolic link Path Traversal | * | 5.5 | — | 2025-12-09 | |
| CVE-2024-32966 | Stored Cross-site Scripting in directory listings via file names in static-web-server | * | 5.8 | — | 2024-05-01 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。