CL
Vendor
Cloudflare
76
CVEs
0
On KEV
3
New 30D
Products
HT9.1
https://github.com/cloudflare/pingora
Cloudflare
6 CVEs0 on KEV3 new
WA9.8
WARP
Cloudflare
19 CVEs0 on KEV0 new
OC9.8
OctoRPKI
Cloudflare
9 CVEs0 on KEV0 new
QU7.5
quiche
Cloudflare
9 CVEs0 on KEV0 new
PI9.1
Pingora
Cloudflare
4 CVEs0 on KEV0 new
WR9.9
Wrangler
Cloudflare
4 CVEs0 on KEV0 new
WM8.5
Warp Mobile Client
Cloudflare
3 CVEs0 on KEV0 new
CI9.8
CIRCL
Cloudflare
2 CVEs0 on KEV0 new
CL7.8
Cloudflared
Cloudflare
2 CVEs0 on KEV0 new
WO9.8
Workers-oauth-provider
Cloudflare
2 CVEs0 on KEV0 new
BO5.3
Boring
Cloudflare
1 CVEs0 on KEV0 new
CF7.5
Cfnts
Cloudflare
1 CVEs0 on KEV0 new
CL6.5
Cloudflare
Cloudflare
1 CVEs0 on KEV0 new
CR9.1
Create-cloudflare
Cloudflare
1 CVEs0 on KEV0 new
GO7.5
goflow
Cloudflare
1 CVEs0 on KEV0 new
GO5.5
gokey
Cloudflare
1 CVEs0 on KEV0 new
GO9.8
Golz4
Cloudflare
1 CVEs0 on KEV0 new
HT8.8
https://github.com/cloudflare/pages-action
Cloudflare
1 CVEs0 on KEV0 new
LO7.5
Lol-html
Cloudflare
1 CVEs0 on KEV0 new
LU7.5
Lua-resty-json
Cloudflare
1 CVEs0 on KEV0 new
MI8.1
Miniflare
Cloudflare
1 CVEs0 on KEV0 new
OD5.9
Odoh-rs
Cloudflare
1 CVEs0 on KEV0 new
US6.8
Universal SSL
Cloudflare
1 CVEs0 on KEV0 new
WO8.1
Workerd
Cloudflare
1 CVEs0 on KEV0 new
WO2.9
workers-sdk
cloudflare
1 CVEs0 on KEV0 new
ZL5.5
Zlib
Cloudflare
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105299 | HT https://github.com/cloudflare/pingora Cloudflare | 8.7 | Oct 20 | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments |
| CVE-2026-105298 | HT https://github.com/cloudflare/pingora Cloudflare | 6.3 | Oct 20 | Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass |
| CVE-2026-105297 | HT https://github.com/cloudflare/pingora Cloudflare | 7.5 | Oct 20 | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits |
| CVE-2026-11325 | HT https://github.com/cloudflare/pages-action Cloudflare | 8.8 | Aug 12 | cloudflare/pages-action is deprecated — migration required by September 18th, 2026 |
| CVE-2026-12523 | QU quiche Cloudflare | 7.5 | Jul 14 | Resource exhaustion in quiche HTTP/3 and QPACK layers |
| CVE-2026-12707 | QU quiche Cloudflare | 7.5 | Jul 14 | Unbounded path event queue growth in quiche via peer-driven source connection ID rotation |
| CVE-2026-14440 | US Universal SSL Cloudflare | 6.8 | Jul 1 | Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records |
| CVE-2026-11941 | QU Quiche Cloudflare | 5.6 | Jun 19 | Use-after-free in connection ID iterator and FFI functions |
| CVE-2026-2836 | HT https://github.com/cloudflare/pingora Cloudflare | 8.1 | Mar 4 | Cache poisoning via insecure-by-default cache key |
| CVE-2026-2835 | HT https://github.com/cloudflare/pingora Cloudflare | 9.1 | Mar 4 | HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing |
| CVE-2026-2833 | HT https://github.com/cloudflare/pingora Cloudflare | 9.1 | Mar 4 | HTTP Request Smuggling via Premature Upgrade |
| CVE-2026-1229 | CI CIRCL Cloudflare | 9.8 | Feb 24 | Incorrect calculation in CIRCL secp384r1 CombinedMult |
| CVE-2026-0933 | WR Wrangler Cloudflare | 9.9 | Jan 20 | OS Command Injection in `wrangler pages deploy` |
| CVE-2025-13353 | GO gokey Cloudflare | 5.5 | Dec 2 | gokey allows secret recovery from a seed file without the master password |
| CVE-2025-59427 | WO workers-sdk cloudflare | 2.9 | Sep 19 | Cloudflare vite plugin exposes secrets over the built-in dev server |
| CVE-2025-7054 | QU quiche Cloudflare | 6.5 | Aug 7 | Infinite loop triggered by connection ID retirement |
| CVE-2025-4821 | QU quiche Cloudflare | 7.5 | Jun 18 | Incorrect congestion window growth by invalid ACK ranges |
| CVE-2025-4820 | QU quiche Cloudflare | 5.3 | Jun 18 | Incorrect congestion window growth by optimistic ACK |
| CVE-2025-6087 | CR Create-cloudflare Cloudflare | 9.1 | Jun 16 | SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint |
| CVE-2025-4366 | PI Pingora Cloudflare | 6.1 | May 22 | Request Smuggling Vulnerability in Pingora |
| CVE-2025-4144 | WO Workers-oauth-provider Cloudflare | 9.8 | May 1 | PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp |
| CVE-2025-4143 | WO Workers-oauth-provider Cloudflare | 6.1 | May 1 | The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on… |
| CVE-2021-3978 | OC Octorpki Cloudflare | 5.5 | Jan 29 | When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root |
| CVE-2025-0651 | WA Warp Cloudflare | 7.1 | Jan 22 | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation |
| CVE-2024-1765 | QU Quiche Cloudflare | 7.5 | Mar 12 | Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running… |
| CVE-2024-1410 | QU Quiche Cloudflare | 5.3 | Mar 12 | Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption |
| CVE-2024-0212 | CL Cloudflare Cloudflare | 6.5 | Jan 29 | The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication |
| CVE-2023-6992 | ZL Zlib Cloudflare | 5.5 | Jan 4 | Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c) |
| CVE-2023-7080 | WR Wrangler Cloudflare | 8.0 | Dec 29 | The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging |
| CVE-2023-7079 | WR Wrangler Cloudflare | 5.7 | Dec 29 | Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network |
| CVE-2023-7078 | MI Miniflare Cloudflare | 8.1 | Dec 29 | Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server |
| CVE-2023-6193 | QU Quiche Cloudflare | 5.3 | Dec 12 | quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path… |
| CVE-2023-6180 | BO Boring Cloudflare | 5.3 | Dec 5 | The tokio-boring library in version 4.0.0 is affected by a memory leak issue that can lead to excessive resource consumption and potential DoS by resource exhaustion |
| CVE-2023-3747 | WA Warp Cloudflare | 5.5 | Sep 7 | Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices |
| CVE-2023-0654 | WA Warp Cloudflare | 3.7 | Aug 29 | Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack |
| CVE-2023-0238 | WA Warp Cloudflare | 5.5 | Aug 29 | Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to… |
| CVE-2023-4241 | LO Lol-html Cloudflare | 7.5 | Aug 16 | lol-html can cause panics on certain HTML inputs |
| CVE-2023-3766 | OD Odoh-rs Cloudflare | 5.9 | Aug 3 | A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries |
| CVE-2023-3348 | WR Wrangler Cloudflare | 5.7 | Aug 3 | The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages… |
| CVE-2023-2754 | WA Warp Cloudflare | 6.8 | Aug 3 | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner,… |
| CVE-2023-1862 | WA Warp Cloudflare | 7.3 | Jun 20 | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an… |
| CVE-2023-3040 | LU Lua-resty-json Cloudflare | 7.5 | Jun 14 | A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have… |
| CVE-2023-3036 | CF Cfnts Cloudflare | 7.5 | Jun 14 | An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71… |
| CVE-2023-2512 | WO Workerd Cloudflare | 8.1 | May 12 | Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow |
| CVE-2023-1732 | CI Circl Cloudflare | 8.2 | May 10 | When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error |
| CVE-2023-0652 | WA Warp Cloudflare | 7.8 | Apr 6 | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a… |
| CVE-2023-1412 | WA Warp Cloudflare | 7.8 | Apr 5 | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations… |
| CVE-2023-1314 | CL Cloudflared Cloudflare | 7.8 | Mar 21 | A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to… |
| CVE-2022-4457 | WA Warp Cloudflare | 5.5 | Jan 11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack |
| CVE-2022-4428 | WA Warp Cloudflare | 8.0 | Jan 11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the… |
| CVE-2014-125026 | GO Golz4 Cloudflare | 9.8 | Dec 27 | LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input |
| CVE-2022-3320 | WA WARP Cloudflare | 9.8 | Oct 28 | Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command |
| CVE-2022-3322 | WA WARP Cloudflare | 7.5 | Oct 28 | Lock WARP switch bypass on WARP mobile client using iOS quick action |
| CVE-2022-3337 | WA WARP Cloudflare | 8.5 | Oct 28 | Lock WARP switch bypass by removing VPN profile on iOS mobile client |
| CVE-2022-3321 | WA WARP Cloudflare | 8.2 | Oct 28 | Lock WARP switch feature bypass on WARP mobile client for iOS |
| CVE-2022-3512 | WA WARP Cloudflare | 8.8 | Oct 28 | Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command |
| CVE-2022-3616 | OC OctoRPKI Cloudflare | 7.5 | Oct 28 | OctoRPKI crash when maximum iterations number is reached |
| CVE-2022-2529 | GO goflow Cloudflare | 7.5 | Sep 30 | Multiple DoS Attack Vectors in sflow packet handling |
| CVE-2022-2225 | WA Warp Cloudflare | 7.8 | Jul 26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g |
| CVE-2022-2145 | WA Warp Cloudflare | 7.8 | Jun 28 | Cloudflare WARP client for Windows (up to v |