Skip to content
OpenAdvisories

Vendor

Cloudflare

66 known vulnerabilities.

Products

WARP 14 quiche 9 octorpki 9 https://github.com/cloudflare/pingora 6 Wrangler 4 WARP Client 4 cloudflared 2 CIRCL 2 lua-resty-json 1 Cloudflare-WordPress 1 gokey 1 tokio-boring 1 lol-html 1 Universal SSL 1 odoh-rs 1 tokio-quiche 1 zlib 1 Cloudflare WARP for Windows 1 workerd 1 goflow 1 miniflare 1 https://github.com/cloudflare/pages-action 1 workers-sdk 1 cfnts 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 2.9
    CVE-2026-1229

    Incorrect calculation in CIRCL secp384r1 CombinedMult

    The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas. ECDH and ECDSA signing relying on this curve are not affected. The bug was fixed…

    Cloudflare CIRCL rclone github.com/cloudflare/circl Ubuntu Alpine Go
  • Low 2.9
    CVE-2025-59427

    Cloudflare vite plugin exposes secrets over the built-in dev server

    The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory t…

    Cloudflare workers-sdk @cloudflare/vite-plugin npm
  • Low 3.7
    CVE-2024-1410

    Unbounded storage of information related to connection ID retirement, in quiche

    Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs); see RFC 9000 S…

    Cloudflare quiche quiche crates.io
  • Low 3.9
    CVE-2023-0654

    Spoofing User's Activity Loads in WARP Mobile Client (Android)

    Due to a misconfiguration, the WARP Mobile Client (< 6.29) for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the …

    Cloudflare WARP Client
  • Low 3.9
    CVE-2023-0238

    Injecting Activity Loads in WARP Mobile Client

    Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a malicious app installed on a victim's device to exploit a peculiarity in an Android function, wherein under certain conditions,…

    Cloudflare WARP Client
  • Low 3.7
    CVE-2023-3040

    Out of Bounds Access Leading to Undefined Behavior

    A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted i…

    Cloudflare lua-resty-json