AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Companies

Cloudflare security advisories

39 advisories across agents, Cloudflare

Company profile
High 8.8Aug 12https://github.com/cloudflare/pages-action: remote code executionhttps://github.com/cloudflare/pages-actionCVE-2026-11325no fix yetHigh 7.5Jul 14Unbounded path event queue growth via peer-driven source connection ID rotationCloudflareCVE-2026-12707fixed in 0.29.3High 7.5Jul 14Resource exhaustion in HTTP/3 and QPACKCloudflareCVE-2026-12523fixed in 0.29.3High 7.6Jul 1Cloudflare Universal SSL: protection mechanism failureUniversal SSLCVE-2026-14440no fix yetMedium 5.6Jun 19Use-after-free in connection ID iterator FFI functionsCloudflareCVE-2026-11941fixed in 0.29.2High 8.4Mar 5Cache poisoning via insecure-by-default cache keyCloudflareCVE-2026-2836fixed in 0.8.0Critical 9.3Mar 5HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding MisparsingCloudflareCVE-2026-2835fixed in 0.8.0Critical 9.3Mar 5HTTP Request Smuggling via Premature UpgradeCloudflareCVE-2026-2833fixed in 0.8.0LowFeb 24Incorrect calculation in circl secp384r1 CombinedMultCloudflareCVE-2026-1229fixed in 1.6.3MediumFeb 13Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteagentsGHSA-w5cr-2qhr-jqc5fixed in 0.3.10MediumFeb 13agents: cross-site scriptingagentsCVE-2026-1721fixed in 0.3.10MediumFeb 3Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email RoutingagentsCVE-2026-1664fixed in 0.3.7High 7.7Jan 21OS Command Injection in `wrangler pages deploy`CloudflareCVE-2026-0933fixed in 4.59.1Medium 4.8Nov 4, 2025Missing validation of redirect_uri on OAuth callback handlerCloudflareGHSA-v85r-hgf6-q875fixed in upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728o...High 8.2Sep 17, 2025Pingora update for MadeYouReset HTTP/2 vulnerabilityCloudflareCVE-2025-8671fixed in 0.6.0High 8.7Aug 7, 2025Infinite loop triggered by connection ID retirementCloudflareCVE-2025-7054fixed in 0.24.5LowJul 7, 2025Cloudflare vite plugin exposes secrets over the built-in dev serverCloudflareCVE-2025-59427fixed in 1.6.0High 7.4Jun 20, 2025Request Smuggling Vulnerability in PingoraCloudflareCVE-2025-4366fixed in 0.5.0High 7.5Jun 17, 2025Incorrect congestion window growth by invalid ACK rangesCloudflareCVE-2025-4821fixed in 0.24.4Medium 5.3Jun 17, 2025Incorrect congestion window growth by optimistic ACKCloudflareCVE-2025-4820fixed in 0.24.4LowJun 10, 2025CIRCL-Fourq: Missing and wrong validation can lead to incorrect resultsCloudflareGHSA-2x5j-vhc8-9cwmfixed in 1.6.1Medium 5.3May 1, 2025PKCE bypass via downgrade attackCloudflareCVE-2025-4144fixed in 0.0.5Medium 6.0May 1, 2025Missing validation of redirect_uri on authorize endpointCloudflareCVE-2025-4143fixed in 0.0.5Medium 5.9Mar 12, 2024Unlimited resource allocation by QUIC CRYPTO frames floodingCloudflareCVE-2024-1765fixed in 0.19.2 +1Low 3.7Mar 12, 2024Unbounded storage of information related to connection ID retirement in quicheCloudflareCVE-2024-1410fixed in 0.19.2 +1High 8.1Jan 29, 2024Information disclosure of Cloudflare API for low privileged usersCloudflareCVE-2024-0212fixed in 4.12.3HighJan 8, 2024Kyber: timing side-channel (kyberslash2)CloudflareGHSA-9763-4f94-gfchfixed in 1.3.7High 8.5Dec 29, 2023Arbitrary remote code execution within `wrangler dev` Workers sandboxCloudflareCVE-2023-7080fixed in 3.19.0 +1Medium 6.9Dec 29, 2023Arbitrary remote file read in Wrangler dev serverCloudflareCVE-2023-7079fixed in 3.19.0High 8.0Dec 29, 2023Server-Side Request Forgery (SSRF) in MiniflareCloudflareCVE-2023-7078fixed in 3.20231030.2Medium 5.3Dec 12, 2023Unbounded queuing of path validation messages in cloudflare-quicheCloudflareCVE-2023-6193fixed in 0.19.1Medium 5.3Dec 5, 2023Resource exhaustion via memory leak in tokio-boringCloudflareCVE-2023-6180fixed in 4.1.0MediumNov 21, 2023WebSocket message can cause crashCloudflareCVE-2023-48230fixed in v1.20231121.0High 7.5Aug 8, 2023lol-html panics on certain HTML inputsCloudflareCVE-2023-4241fixed in 1.1.1Medium 5.7Aug 3, 2023Directory traversal vulnerability in Cloudflare WranglerCloudflareCVE-2023-3348fixed in 3.1.1 +1Medium 6.5May 12, 2023Buffer under-read in workerdCloudflareCVE-2023-2512fixed in v1.20230419.0Medium 5.3May 10, 2023Improper random reading in CIRCLCloudflareCVE-2023-1732fixed in 1.3.3High 7.5Mar 21, 2023Local Privilege Escalation Vulnerability in cloudflared's InstallerCloudflareCVE-2023-1314fixed in 2023.3.1MediumSep 16, 2020Local Privilege Escalation in cloudflaredCloudflareCVE-2020-24356fixed in 2020.8.1
About Cloudflare

Cloudflare, Inc., is an American technology company headquartered in San Francisco, California, that provides a range of internet services, including content delivery network (CDN) services, cloud cybersecurity, DDoS mitigation, and ICANN-accredited domain registration.

Elsewhere on Ibis: Acquisitions · Quarterly · Paydays · Releases · Repos · TechConf · Trending