WA
Product
WARP
by Cloudflare · last CVE Jan 22, 2025
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 13Medium 4Low 1
Watch

Add WARP to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-3320
9.8
0%
Oct 28
Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command
Affected: before 2022.8.857.0; before 2022.8.936; before 2022.8.861.0
CVE-2022-3512
8.8
0%
Oct 28
Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command
Affected: before 2022.8.857; before 2022.8.936; before 2022.8.861
CVE-2022-3337
8.5
0%
Oct 28
Lock WARP switch bypass by removing VPN profile on iOS mobile client
Affected: before 6.15
CVE-2022-3321
8.2
0%
Oct 28
Lock WARP switch feature bypass on WARP mobile client for iOS
Affected: before 6.14
CVE-2022-4428
8.0
1%
Jan 11
support_uri validation missing in WARP client for Windows
Affected: through 2022.10.106.0
CVE-2023-0652
7.8
0%
Apr 6
Local Privilege Escalation in Cloudflare WARP Installer (Windows)
Affected: through 2022.5.309.0
CVE-2023-1412
7.8
0%
Apr 5
Local Privilege Escalation Vulnerability in WARP's MSI Installer
Affected: through 2022.5.309.0
CVE-2022-2225
7.8
0%
Jul 26
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g
Affected: before 2022.5.227.0; before 2022.5.341.0; before 2022.5.346
CVE-2022-2145
7.8
0%
Jun 28
Cloudflare WARP client for Windows (up to v
Affected: before 2022.5.309.0
CVE-2022-2147
7.8
0%
Jun 23
Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation
Affected: 2022.2.95.0 before 2022.3.186.0
CVE-2020-35152
7.8
0%
Feb 3
Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path
Affected: before 1.2.2695.1
CVE-2022-3322
7.5
0%
Oct 28
Lock WARP switch bypass on WARP mobile client using iOS quick action
Affected: before 6.14
CVE-2023-1862
7.3
1%
Jun 20
Remote access to warp-svc.exe in Cloudflare WARP
Affected: through 2023.3.381.0
CVE-2025-0651
7.1
0%
Jan 22
File symlink abuse might lead to deleting files belonging to SYSTEM user
Affected: before 2024.12.492.0
CVE-2023-2754
6.8
1%
Aug 3
Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client
Affected: before 2023.7.160.0
CVE-2023-3747
5.5
0%
Sep 7
Insufficient Validation on Override Codes for Always-Enabled WARP Mode
Affected: 6.29
CVE-2023-0238
5.5
0%
Aug 29
Injecting Activity Loads in WARP Mobile Client
Affected: before 6.29
CVE-2022-4457
5.5
0%
Jan 11
WARP client manifest misconfiguration leading to Task Hijacking
Affected: before <6.20
CVE-2023-0654
3.7
0%
Aug 29
Spoofing User's Activity Loads in WARP Mobile Client (Android)
Affected: before 6.29
Showing 19