# Cloudflare CVEs > Cloudflare: 29 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/cloudflare/cves Last updated: 2026-10-20T01:07:12Z 29 CVEs map to Cloudflare (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Cloudflare](https://rewindex.com/company/cloudflare.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Cloudflare’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-20 | [CVE-2026-105299](https://rewindex.com/cve/CVE-2026-105299.md) | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments | 8.7 high | | | 2026-10-20 | [CVE-2026-105298](https://rewindex.com/cve/CVE-2026-105298.md) | Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass | 6.3 medium | | | 2026-10-20 | [CVE-2026-105297](https://rewindex.com/cve/CVE-2026-105297.md) | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits | 7.5 high | | | 2026-08-12 | [CVE-2026-11325](https://rewindex.com/cve/CVE-2026-11325.md) | cloudflare/pages-action is deprecated — migration required by September 18th, 2026 | 8.8 high | | | 2026-07-14 | [CVE-2026-12523](https://rewindex.com/cve/CVE-2026-12523.md) | Resource exhaustion in quiche HTTP/3 and QPACK layers | 7.5 high | | | 2026-07-14 | [CVE-2026-12707](https://rewindex.com/cve/CVE-2026-12707.md) | Unbounded path event queue growth in quiche via peer-driven source connection ID rotation | 7.5 high | | | 2026-07-01 | [CVE-2026-14440](https://rewindex.com/cve/CVE-2026-14440.md) | Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records | 6.8 medium | | | 2026-06-19 | [CVE-2026-11941](https://rewindex.com/cve/CVE-2026-11941.md) | Use-after-free in connection ID iterator and FFI functions | 5.6 medium | | | 2026-03-04 | [CVE-2026-2836](https://rewindex.com/cve/CVE-2026-2836.md) | Cache poisoning via insecure-by-default cache key | 8.1 high | | | 2026-03-04 | [CVE-2026-2835](https://rewindex.com/cve/CVE-2026-2835.md) | HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing | 9.1 critical | | | 2026-03-04 | [CVE-2026-2833](https://rewindex.com/cve/CVE-2026-2833.md) | HTTP Request Smuggling via Premature Upgrade | 9.1 critical | | | 2026-03-04 | [CVE-2026-3125](https://rewindex.com/cve/CVE-2026-3125.md) | SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass | 6.5 medium | | | 2026-02-24 | [CVE-2026-1229](https://rewindex.com/cve/CVE-2026-1229.md) | Incorrect calculation in CIRCL secp384r1 CombinedMult | 9.8 critical | | | 2026-02-13 | [CVE-2026-1721](https://rewindex.com/cve/CVE-2026-1721.md) | Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site | 6.2 medium | | | 2026-02-03 | [CVE-2026-1664](https://rewindex.com/cve/CVE-2026-1664.md) | Insecure Direct Object Reference (IDOR) via Header-Based Email Routing | 6.9 medium | | | 2026-01-20 | [CVE-2026-0933](https://rewindex.com/cve/CVE-2026-0933.md) | OS Command Injection in \`wrangler pages deploy\` | 9.9 critical | | | 2025-12-02 | [CVE-2025-13353](https://rewindex.com/cve/CVE-2025-13353.md) | gokey allows secret recovery from a seed file without the master password | 5.5 medium | | | 2025-09-19 | [CVE-2025-59427](https://rewindex.com/cve/CVE-2025-59427.md) | Cloudflare vite plugin exposes secrets over the built-in dev server | 2.9 low | | | 2025-08-07 | [CVE-2025-7054](https://rewindex.com/cve/CVE-2025-7054.md) | Infinite loop triggered by connection ID retirement | 6.5 medium | | | 2025-06-18 | [CVE-2025-4821](https://rewindex.com/cve/CVE-2025-4821.md) | Incorrect congestion window growth by invalid ACK ranges | 7.5 high | | | 2025-06-18 | [CVE-2025-4820](https://rewindex.com/cve/CVE-2025-4820.md) | Incorrect congestion window growth by optimistic ACK | 5.3 medium | | | 2025-06-16 | [CVE-2025-6087](https://rewindex.com/cve/CVE-2025-6087.md) | SSRF vulnerability in opennextjs-cloudflare via /\_next/image endpoint | 9.1 critical | | | 2025-05-22 | [CVE-2025-4366](https://rewindex.com/cve/CVE-2025-4366.md) | Request Smuggling Vulnerability in Pingora | 6.1 medium | | | 2025-05-13 | [CVE-2025-4658](https://rewindex.com/cve/CVE-2025-4658.md) | Authentication Bypass in OPKSSH | 9.8 critical | | | 2025-05-13 | [CVE-2025-3757](https://rewindex.com/cve/CVE-2025-3757.md) | Authentication Bypass in OpenPubKey | 9.8 critical | | | 2025-05-01 | [CVE-2025-4144](https://rewindex.com/cve/CVE-2025-4144.md) | PKCE bypass via downgrade attack | 9.8 critical | | | 2025-05-01 | [CVE-2025-4143](https://rewindex.com/cve/CVE-2025-4143.md) | Missing validation of redirect\_uri on authorize endpoint | 6.1 medium | | | 2025-01-29 | [CVE-2021-3978](https://rewindex.com/cve/CVE-2021-3978.md) | Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki | 7.5 high | | | 2025-01-22 | [CVE-2025-0651](https://rewindex.com/cve/CVE-2025-0651.md) | File symlink abuse might lead to deleting files belonging to SYSTEM user | 7.1 high | | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Cloudflare) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 1 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 2 | 1 | 1 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 2 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 2 | 1 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/cloudflare/cves · Markdown: https://rewindex.com/company/cloudflare/cves.md · JSON: https://rewindex.com/api/v1/companies/cloudflare/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:45:44.104Z