WA
Product
WARP
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 13Medium 4Low 1
Watch
Add WARP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-3320 | 9.8 | Oct 28 | Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command Affected: before 2022.8.857.0; before 2022.8.936; before 2022.8.861.0 |
| CVE-2022-3512 | 8.8 | Oct 28 | Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command Affected: before 2022.8.857; before 2022.8.936; before 2022.8.861 |
| CVE-2022-3337 | 8.5 | Oct 28 | Lock WARP switch bypass by removing VPN profile on iOS mobile client Affected: before 6.15 |
| CVE-2022-3321 | 8.2 | Oct 28 | Lock WARP switch feature bypass on WARP mobile client for iOS Affected: before 6.14 |
| CVE-2022-4428 | 8.0 | Jan 11 | support_uri validation missing in WARP client for Windows Affected: through 2022.10.106.0 |
| CVE-2023-0652 | 7.8 | Apr 6 | Local Privilege Escalation in Cloudflare WARP Installer (Windows) Affected: through 2022.5.309.0 |
| CVE-2023-1412 | 7.8 | Apr 5 | Local Privilege Escalation Vulnerability in WARP's MSI Installer Affected: through 2022.5.309.0 |
| CVE-2022-2225 | 7.8 | Jul 26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g Affected: before 2022.5.227.0; before 2022.5.341.0; before 2022.5.346 |
| CVE-2022-2145 | 7.8 | Jun 28 | Cloudflare WARP client for Windows (up to v Affected: before 2022.5.309.0 |
| CVE-2022-2147 | 7.8 | Jun 23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation Affected: 2022.2.95.0 before 2022.3.186.0 |
| CVE-2020-35152 | 7.8 | Feb 3 | Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path Affected: before 1.2.2695.1 |
| CVE-2022-3322 | 7.5 | Oct 28 | Lock WARP switch bypass on WARP mobile client using iOS quick action Affected: before 6.14 |
| CVE-2023-1862 | 7.3 | Jun 20 | Remote access to warp-svc.exe in Cloudflare WARP Affected: through 2023.3.381.0 |
| CVE-2025-0651 | 7.1 | Jan 22 | File symlink abuse might lead to deleting files belonging to SYSTEM user Affected: before 2024.12.492.0 |
| CVE-2023-2754 | 6.8 | Aug 3 | Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client Affected: before 2023.7.160.0 |
| CVE-2023-3747 | 5.5 | Sep 7 | Insufficient Validation on Override Codes for Always-Enabled WARP Mode Affected: 6.29 |
| CVE-2023-0238 | 5.5 | Aug 29 | Injecting Activity Loads in WARP Mobile Client Affected: before 6.29 |
| CVE-2022-4457 | 5.5 | Jan 11 | WARP client manifest misconfiguration leading to Task Hijacking Affected: before <6.20 |
| CVE-2023-0654 | 3.7 | Aug 29 | Spoofing User's Activity Loads in WARP Mobile Client (Android) Affected: before 6.29 |
Showing 19
