Log in Start free

Cloudflare

Products

ProductCVEsExploitedLatest
WARP14–Jan 22, 2025
Quiche9–Jul 14, 2026
OctoRPKI9–Jan 29, 2025
https://github.com/cloudflare/pingora6–Oct 20, 2026
WARP Client4–Sep 7, 2023
Wrangler4–Jan 20, 2026
CIRCL2–Feb 24, 2026
cloudflared2–Mar 21, 2023
miniflare1–Dec 29, 2023
odoh-rs1–Aug 3, 2023
tokio-boring1–Dec 5, 2023
Universal SSL1–Jul 1, 2026
workerd1–May 12, 2023
workers-sdk1–Sep 19, 2025
cfnts1–Jun 14, 2023
zlib1–Jan 4, 2024
Cloudflare WARP for Windows1–Feb 2, 2021
Cloudflare-WordPress1–Jan 29, 2024
goflow1–Sep 30, 2022
gokey1–Dec 2, 2025
https://github.com/cloudflare/pages-action1–Aug 12, 2026
lol-html1–Aug 16, 2023
lua-resty-json1–Jun 14, 2023

Exploited and recent CVEs

  • CVE-2026-105299 High 8.7 Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments 0.4%
  • CVE-2026-105298 Medium 6.3 Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass 0.6%
  • CVE-2026-105297 High 7.5 Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits 0.4%
  • CVE-2026-11325 High 8.8 cloudflare/pages-action is deprecated — migration required by September 18th, 2026 0.7%
  • CVE-2026-12523 High 7.5 Resource exhaustion in quiche HTTP/3 and QPACK layers 0.5%
  • CVE-2026-12707 High 7.5 Unbounded path event queue growth in quiche via peer-driven source connection ID rotation 0.4%
  • CVE-2026-14440 Medium 6.8 Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records 0.2%
  • CVE-2026-11941 Medium 5.6 Use-after-free in connection ID iterator and FFI functions 0.3%
  • CVE-2026-2836 High 8.4 Cache poisoning via insecure-by-default cache key 0.4%
  • CVE-2026-2835 Critical 9.3 HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing 0.8%
  • CVE-2026-2833 Critical 9.3 HTTP Request Smuggling via Premature Upgrade 0.7%
  • CVE-2026-1229 Low 2.9 Incorrect calculation in CIRCL secp384r1 CombinedMult 0.4%
  • CVE-2026-0933 High 7.7 OS Command Injection in `wrangler pages deploy` 1.5%
  • CVE-2025-13353 High 7.1 gokey allows secret recovery from a seed file without the master password 0.2%
  • CVE-2025-59427 Low 2.9 Cloudflare vite plugin exposes secrets over the built-in dev server 0.4%
  • CVE-2025-7054 High 8.7 Infinite loop triggered by connection ID retirement 0.4%
  • CVE-2025-4821 High 7.5 Incorrect congestion window growth by invalid ACK ranges 1.0%
  • CVE-2025-4820 Medium 5.3 Incorrect congestion window growth by optimistic ACK 0.9%
  • CVE-2021-3978 High 7.5 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki 0.1%
  • CVE-2025-0651 Medium 6.1 File symlink abuse might lead to deleting files belonging to SYSTEM user 0.3%
  • CVE-2024-1410 Low 3.7 Unbounded storage of information related to connection ID retirement, in quiche 0.7%
  • CVE-2024-1765 Medium 5.9 Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche 1.1%
  • CVE-2024-0212 High 8.1 Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) 0.8%
  • CVE-2023-6992 Medium 4.0 Memory corruption issues is Cloudflare zlib implementation 0.2%
  • CVE-2023-7080 High 8.5 Arbitrary remote code execution within wrangler dev Workers sandbox 0.6%
  • CVE-2023-7079 Medium 6.4 Arbitrary remote file read in Wrangler dev server 0.7%
  • CVE-2023-7078 High 7.5 Server-Side Request Forgery (SSRF) in Miniflare 0.6%
  • CVE-2023-6193 Medium 5.3 Unbounded queuing of path validation messages in cloudflare-quiche 0.8%
  • CVE-2023-6180 Medium 5.3 Resource exhaustion via memory leak in tokio-boring 0.6%
  • CVE-2023-3747 Medium 5.5 Insufficient Validation on Override Codes for Always-Enabled WARP Mode 0.2%