Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how cloudflare compares to other vendors in security performance

View Risk Score →

Software

cloudflare warp
16
cloudflare octorpki
8
cloudflare pingora
5
cloudflare quiche
5
cloudflare warp windows
3
cloudflare wrangler
3
cloudflare cdn
2
cloudflare cloudflared
2
cloudflare workers
2
cloudflare workers oauth provider
2
cloudflare acme
1
cloudflare ai gateway
1
cloudflare cfnts rust
1
cloudflare circl
1
cloudflare circl (fourq implementation)
1
cloudflare circl go
1
cloudflare circl-fourq
1
cloudflare cloudflare universal ssl
1
cloudflare content delivery network (cdn)
1
cloudflare create-cloudflare node.js
1
cloudflare dnssec-validated dns services
1
cloudflare goflow
1
cloudflare gokey go
1
cloudflare golz4
1
cloudflare image resizing
1
cloudflare lol-html
1
cloudflare lua-resty-json
1
cloudflare miniflare
1
cloudflare odoh
1
cloudflare offload, ai & optimize with cloudflare images
1
cloudflare pingora proxy
1
cloudflare quiche rust
1
cloudflare react server components
1
cloudflare react2shell
1
cloudflare universal ssl
1
cloudflare warp linux
1
cloudflare warp macos
1
cloudflare wordpress
1
cloudflare workers ai
1
cloudflare workers-oauth-provider
1
cloudflare wrangler node.js
1
cloudflare zlib
1

Cloudflare’s CAA flaw looks impractical for criminals — but what about actors who control the network?

First published (updated )
Social
reddit

Cloudflare quicheResource exhaustion in quiche HTTP/3 and QPACK layers

Risk 43
Severity
7.5
First published (updated )
CVE-2026-12523

Cloudflare quicheUnbounded path event queue growth in quiche via peer-driven source connection ID rotation

Risk 43
Severity
7.5
First published (updated )
CVE-2026-12707

Cloudflare Universal SSLCloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records

Risk 56
Severity
7.6
First published (updated )
CVE-2026-14440

Cloudflare quicheUse-after-free in connection ID iterator and FFI functions

Risk 42
Severity
5.6
First published (updated )
CVE-2026-11941
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Cloudflare Offload, AI & Optimize with Cloudflare ImagesOffload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action

Risk 57
Severity
8.8
EPSS
0.56%
First published (updated )
CVE-2026-9860

Nginx nginxWe’re publishing HTTP/2 Bomb, a remote denial-of-service exploit against most major web servers, inc…

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2485371

oss-secHTTP/2 Bomb affects Apache httpd, nginx, envoy, & pingora

First published (updated )
https://seclists.org/oss-sec/2026/q2/790

Dark ReadingContent Delivery Exploit Opens Websites to Brand Hijacking

Exploited
First published (updated )
News
Dark Reading

Pingora PingoraCache poisoning via insecure-by-default cache key

Risk 46
Severity
8.4
EPSS
0.01%
First published (updated )
CVE-2026-2836
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Pingora PingoraHTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

Risk 50
Severity
9.3
EPSS
0.06%
First published (updated )
CVE-2026-2835

Pingora PingoraHTTP Request Smuggling via Premature Upgrade

Risk 50
Severity
9.3
EPSS
0.06%
First published (updated )
CVE-2026-2833

github/cloudflare/circlIncorrect calculation in CIRCL secp384r1 CombinedMult

Risk 86
Severity
9.8
First published (updated )
CVE-2026-1229

The RegisterCloudflare whacks WAF bypass bug that opened side door for attackers

First published (updated )
News
The Register

npm/wranglerOS Command Injection in `wrangler pages deploy`

Risk 59
Severity
9.9
EPSS
0.51%
First published (updated )
CVE-2026-0933
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

The RegisterCloudflare blames Friday outage on borked fix for React2shell vuln

First published (updated )
News
The Register

BleepingComputerCloudflare blames today's outage on React2Shell mitigations

Exploited
Zeroday
First published (updated )
News
BleepingComputer

gokey gokeygokey allows secret recovery from a seed file without the master password

Risk 66
Severity
7.1
First published (updated )
CVE-2025-13353

BleepingComputerClickFix malware attacks evolve with multi-OS support, video tutorials

First published (updated )
News
BleepingComputer

BleepingComputerPhantomCaptcha ClickFix attack targets Ukraine war relief orgs

Exploited
First published (updated )
News
BleepingComputer
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Cryptographic Issues in Cloudflare's Circl FourQ Implementation (CVE-2025-8556)

First published (updated )
Social
reddit

Cloudflare Vite pluginCloudflare vite plugin exposes secrets over the built-in dev server

Risk 18
Severity
2.9
First published (updated )
CVE-2025-59427

The RegisterCloudflare DDoSed itself with React useEffect hook blunder

First published (updated )
News
The Register

The RegisterHow big will this Drift get? Cloudflare cops to Salesloft Drift breach

First published (updated )
News
The Register

BleepingComputerCloudflare hit by data breach in Salesloft Drift supply chain attack

First published (updated )
News
BleepingComputer
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Cloudflare Image ResizingCloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook

Risk 61
Severity
9.8
EPSS
0.52%
First published (updated )
CVE-2025-8723

Cloudflare quicheInfinite loop triggered by connection ID retirement

Risk 47
Severity
8.7
First published (updated )
CVE-2025-7054

Cloudflare quicheIncorrect congestion window growth by invalid ACK ranges

Risk 43
Severity
7.5
First published (updated )
CVE-2025-4821

Cloudflare quicheIncorrect congestion window growth by optimistic ACK

Risk 27
Severity
5.3
First published (updated )
CVE-2025-4820

npm/@opennextjs/cloudflareSSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

Risk 47
Severity
7.8
EPSS
0.09%
First published (updated )
CVE-2025-6087
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203