CL
Vendor
Cloudflare
82
CVEs
0
On KEV
3
New 30D
Products
HT9.1
https://github.com/cloudflare/pingora
Cloudflare
6 CVEs0 on KEV3 new
WA9.8
WARP
Cloudflare
19 CVEs0 on KEV0 new
OC9.8
octorpki
Cloudflare
9 CVEs0 on KEV0 new
QU7.5
quiche
Cloudflare
9 CVEs0 on KEV0 new
PI9.1
Pingora
Cloudflare
4 CVEs0 on KEV0 new
WC7.3
WARP Client
Cloudflare
4 CVEs0 on KEV0 new
WR9.9
wrangler
Cloudflare
4 CVEs0 on KEV0 new
WM8.5
Warp Mobile Client
Cloudflare
3 CVEs0 on KEV0 new
CI9.8
CIRCL
Cloudflare
2 CVEs0 on KEV0 new
CL7.8
cloudflared
Cloudflare
2 CVEs0 on KEV0 new
WO9.8
Workers-oauth-provider
Cloudflare
2 CVEs0 on KEV0 new
BO5.3
Boring
Cloudflare
1 CVEs0 on KEV0 new
CF7.5
cfnts
Cloudflare
1 CVEs0 on KEV0 new
CL6.5
Cloudflare
Cloudflare
1 CVEs0 on KEV0 new
CL6.5
Cloudflare-WordPress
Cloudflare
1 CVEs0 on KEV0 new
CR9.1
Create-cloudflare
Cloudflare
1 CVEs0 on KEV0 new
GO7.5
goflow
Cloudflare
1 CVEs0 on KEV0 new
GO5.5
gokey
Cloudflare
1 CVEs0 on KEV0 new
GO9.8
Golz4
Cloudflare
1 CVEs0 on KEV0 new
HT8.8
https://github.com/cloudflare/pages-action
Cloudflare
1 CVEs0 on KEV0 new
LO7.5
lol-html
Cloudflare
1 CVEs0 on KEV0 new
LU7.5
lua-resty-json
Cloudflare
1 CVEs0 on KEV0 new
MI8.1
miniflare
Cloudflare
1 CVEs0 on KEV0 new
OD5.9
odoh-rs
Cloudflare
1 CVEs0 on KEV0 new
TO5.3
tokio-boring
Cloudflare
1 CVEs0 on KEV0 new
US6.8
Universal SSL
Cloudflare
1 CVEs0 on KEV0 new
WO8.1
workerd
Cloudflare
1 CVEs0 on KEV0 new
WO2.9
workers-sdk
cloudflare
1 CVEs0 on KEV0 new
ZL5.5
zlib
Cloudflare
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105299 | HT https://github.com/cloudflare/pingora Cloudflare | 8.7 | Oct 20 | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments |
| CVE-2026-105298 | HT https://github.com/cloudflare/pingora Cloudflare | 6.3 | Oct 20 | Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass |
| CVE-2026-105297 | HT https://github.com/cloudflare/pingora Cloudflare | 7.5 | Oct 20 | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits |
| CVE-2026-11325 | HT https://github.com/cloudflare/pages-action Cloudflare | 8.8 | Aug 12 | cloudflare/pages-action is deprecated — migration required by September 18th, 2026 |
| CVE-2026-12523 | QU quiche Cloudflare | 7.5 | Jul 14 | Resource exhaustion in quiche HTTP/3 and QPACK layers |
| CVE-2026-12707 | QU quiche Cloudflare | 7.5 | Jul 14 | Unbounded path event queue growth in quiche via peer-driven source connection ID rotation |
| CVE-2026-14440 | US Universal SSL Cloudflare | 6.8 | Jul 1 | Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records |
| CVE-2026-11941 | QU Quiche Cloudflare | 5.6 | Jun 19 | Use-after-free in connection ID iterator and FFI functions |
| CVE-2026-2836 | HT https://github.com/cloudflare/pingora Cloudflare | 8.1 | Mar 4 | Cache poisoning via insecure-by-default cache key |
| CVE-2026-2835 | HT https://github.com/cloudflare/pingora Cloudflare | 9.1 | Mar 4 | HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing |
| CVE-2026-2833 | HT https://github.com/cloudflare/pingora Cloudflare | 9.1 | Mar 4 | HTTP Request Smuggling via Premature Upgrade |
| CVE-2026-1229 | CI CIRCL Cloudflare | 9.8 | Feb 24 | Incorrect calculation in CIRCL secp384r1 CombinedMult |
| CVE-2026-0933 | WR Wrangler Cloudflare | 9.9 | Jan 20 | OS Command Injection in `wrangler pages deploy` |
| CVE-2025-13353 | GO gokey Cloudflare | 5.5 | Dec 2 | gokey allows secret recovery from a seed file without the master password |
| CVE-2025-59427 | WO workers-sdk cloudflare | 2.9 | Sep 19 | Cloudflare vite plugin exposes secrets over the built-in dev server |
| CVE-2025-7054 | QU quiche Cloudflare | 6.5 | Aug 7 | Infinite loop triggered by connection ID retirement |
| CVE-2025-4821 | QU quiche Cloudflare | 7.5 | Jun 18 | Incorrect congestion window growth by invalid ACK ranges |
| CVE-2025-4820 | QU quiche Cloudflare | 5.3 | Jun 18 | Incorrect congestion window growth by optimistic ACK |
| CVE-2025-6087 | CR Create-cloudflare Cloudflare | 9.1 | Jun 16 | SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint |
| CVE-2025-4366 | PI Pingora Cloudflare | 6.1 | May 22 | Request Smuggling Vulnerability in Pingora |
| CVE-2025-4144 | WO Workers-oauth-provider Cloudflare | 9.8 | May 1 | PKCE bypass via downgrade attack |
| CVE-2025-4143 | WO Workers-oauth-provider Cloudflare | 6.1 | May 1 | Missing validation of redirect_uri on authorize endpoint |
| CVE-2021-3978 | OC octorpki Cloudflare | 5.5 | Jan 29 | Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki |
| CVE-2025-0651 | WA WARP Cloudflare | 7.1 | Jan 22 | File symlink abuse might lead to deleting files belonging to SYSTEM user |
| CVE-2024-1410 | QU quiche Cloudflare | 5.3 | Mar 12 | Unbounded storage of information related to connection ID retirement, in quiche |
| CVE-2024-1765 | QU quiche Cloudflare | 7.5 | Mar 12 | Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche |
| CVE-2024-0212 | CL Cloudflare-WordPress Cloudflare | 6.5 | Jan 29 | Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) |
| CVE-2023-6992 | ZL zlib Cloudflare | 5.5 | Jan 4 | Memory corruption issues is Cloudflare zlib implementation |
| CVE-2023-7080 | WR wrangler Cloudflare | 8.0 | Dec 29 | Arbitrary remote code execution within wrangler dev Workers sandbox |
| CVE-2023-7079 | WR wrangler Cloudflare | 5.7 | Dec 29 | Arbitrary remote file read in Wrangler dev server |
| CVE-2023-7078 | MI miniflare Cloudflare | 8.1 | Dec 29 | Server-Side Request Forgery (SSRF) in Miniflare |
| CVE-2023-6193 | QU quiche Cloudflare | 5.3 | Dec 12 | Unbounded queuing of path validation messages in cloudflare-quiche |
| CVE-2023-6180 | TO tokio-boring Cloudflare | 5.3 | Dec 5 | Resource exhaustion via memory leak in tokio-boring |
| CVE-2023-3747 | WC WARP Client Cloudflare | 5.5 | Sep 7 | Insufficient Validation on Override Codes for Always-Enabled WARP Mode |
| CVE-2023-0654 | WC WARP Client Cloudflare | 3.7 | Aug 29 | Spoofing User's Activity Loads in WARP Mobile Client (Android) |
| CVE-2023-0238 | WC WARP Client Cloudflare | 5.5 | Aug 29 | Injecting Activity Loads in WARP Mobile Client |
| CVE-2023-4241 | LO lol-html Cloudflare | 7.5 | Aug 16 | lol-html panics on certain HTML inputs |
| CVE-2023-2754 | WA WARP Cloudflare | 6.8 | Aug 3 | Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client |
| CVE-2023-3766 | OD odoh-rs Cloudflare | 5.9 | Aug 3 | Invalid Slice Split Results in Server Panic |
| CVE-2023-3348 | WR Wrangler Cloudflare | 5.7 | Aug 3 | Directory traversal vulnerability in Cloudflare Wrangler |
| CVE-2023-1862 | WC WARP Client Cloudflare | 7.3 | Jun 20 | Remote access to warp-svc.exe in Cloudflare WARP |
| CVE-2023-3040 | LU lua-resty-json Cloudflare | 7.5 | Jun 14 | Out of Bounds Access Leading to Undefined Behavior |
| CVE-2023-3036 | CF cfnts Cloudflare | 7.5 | Jun 14 | Out of Bounds Slice index in cfnts leads to remote panic |
| CVE-2023-2512 | WO workerd Cloudflare | 8.1 | May 12 | Buffer under-read in workerd |
| CVE-2023-1732 | CI CIRCL Cloudflare | 8.2 | May 10 | Improper random reading in CIRCL |
| CVE-2023-0652 | WA WARP Cloudflare | 7.8 | Apr 6 | Local Privilege Escalation in Cloudflare WARP Installer (Windows) |
| CVE-2023-1412 | WA WARP Cloudflare | 7.8 | Apr 5 | Local Privilege Escalation Vulnerability in WARP's MSI Installer |
| CVE-2023-1314 | CL cloudflared Cloudflare | 7.8 | Mar 21 | Local Privilege Escalation Vulnerability in cloudflared's Installer |
| CVE-2022-4428 | WA WARP Cloudflare | 8.0 | Jan 11 | support_uri validation missing in WARP client for Windows |
| CVE-2022-4457 | WA WARP Cloudflare | 5.5 | Jan 11 | WARP client manifest misconfiguration leading to Task Hijacking |
| CVE-2014-125026 | GO Golz4 Cloudflare | 9.8 | Dec 27 | Out-of-bounds write in github.com/cloudflare/golz4 |
| CVE-2022-3320 | WA WARP Cloudflare | 9.8 | Oct 28 | Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command |
| CVE-2022-3322 | WA WARP Cloudflare | 7.5 | Oct 28 | Lock WARP switch bypass on WARP mobile client using iOS quick action |
| CVE-2022-3337 | WA WARP Cloudflare | 8.5 | Oct 28 | Lock WARP switch bypass by removing VPN profile on iOS mobile client |
| CVE-2022-3321 | WA WARP Cloudflare | 8.2 | Oct 28 | Lock WARP switch feature bypass on WARP mobile client for iOS |
| CVE-2022-3512 | WA WARP Cloudflare | 8.8 | Oct 28 | Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command |
| CVE-2022-3616 | OC OctoRPKI Cloudflare | 7.5 | Oct 28 | OctoRPKI crash when maximum iterations number is reached |
| CVE-2022-2529 | GO goflow Cloudflare | 7.5 | Sep 30 | Multiple DoS Attack Vectors in sflow packet handling |
| CVE-2022-2225 | WA Warp Cloudflare | 7.8 | Jul 26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g |
| CVE-2022-2145 | WA Warp Cloudflare | 7.8 | Jun 28 | Cloudflare WARP client for Windows (up to v |