Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,797All CVEsplus 19,115 rejected
- 486Last 24 hours2,895 in the last 7 days
- 16,846Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 9 | 4 | 1 | 0 | 16 | 73 |
| 2025 | 2 | 6 | 4 | 0 | 0 | 12 | 57 |
| 2024 | 0 | 1 | 2 | 1 | 0 | 4 | 45 |
| 2023 | 0 | 10 | 9 | 3 | 0 | 22 | 41 |
| 2022 | 0 | 2 | 8 | 0 | 0 | 10 | 19 |
| 2021 | 0 | 2 | 6 | 0 | 0 | 8 | 9 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-105299 | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentsCloudflare · https://github.com/cloudflare/pingora | High8.7 |
| CVE-2026-105298 | Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypassCloudflare · https://github.com/cloudflare/pingora | Medium6.3 |
| CVE-2026-105297 | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitsCloudflare · https://github.com/cloudflare/pingora | High7.5 |
| CVE-2026-11325 | cloudflare/pages-action is deprecated — migration required by September 18th, 2026Cloudflare · https://github.com/cloudflare/pages-action | High8.8 |
| CVE-2026-12523 | Resource exhaustion in quiche HTTP/3 and QPACK layersCloudflare · quiche | High7.5 |
| CVE-2026-12707 | Unbounded path event queue growth in quiche via peer-driven source connection ID rotationCloudflare · quiche | High7.5 |
| CVE-2026-14440 | Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA recordsCloudflare · Universal SSL | High7.6 |
| CVE-2026-11941 | Use-after-free in connection ID iterator and FFI functionsCloudflare · Quiche | Medium5.6 |
| CVE-2026-2836 | Cache poisoning via insecure-by-default cache keyCloudflare · https://github.com/cloudflare/pingora | High8.4 |
| CVE-2026-2835 | HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding MisparsingCloudflare · https://github.com/cloudflare/pingora | Critical9.3 |
| CVE-2026-2833 | HTTP Request Smuggling via Premature UpgradeCloudflare · https://github.com/cloudflare/pingora | Critical9.3 |
| CVE-2026-3125 | SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypassopennextjs · @opennextjs/cloudflare | High7.7 |
| CVE-2026-1229 | Incorrect calculation in CIRCL secp384r1 CombinedMultCloudflare · CIRCL | Low2.9 |
| CVE-2026-1721 | Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteagents | Medium6.2 |
| CVE-2026-1664 | Insecure Direct Object Reference (IDOR) via Header-Based Email Routingagents | Medium6.9 |
| CVE-2026-0933 | OS Command Injection in `wrangler pages deploy`Cloudflare · Wrangler | High7.7 |
| CVE-2025-13353 | gokey allows secret recovery from a seed file without the master passwordCloudflare · gokey | High7.1 |
| CVE-2025-7054 | Infinite loop triggered by connection ID retirementCloudflare · quiche | High8.7 |
| CVE-2025-4821 | Incorrect congestion window growth by invalid ACK rangesCloudflare · quiche | High7.5 |
| CVE-2025-4820 | Incorrect congestion window growth by optimistic ACKCloudflare · quiche | Medium5.3 |
| CVE-2025-6087 | SSRF vulnerability in opennextjs-cloudflare via /_next/image endpointopennextjs-cloudflare | High7.8 |
| CVE-2025-4366 | Request Smuggling Vulnerability in PingoraPingora | High7.4 |
| CVE-2025-4658 | Authentication Bypass in OPKSSHOPKSSH · OPKSSH | Critical9.3 |
| CVE-2025-3757 | Authentication Bypass in OpenPubKeyOPKSSH · OPKSSH | Critical9.3 |
| CVE-2025-4144 | PKCE bypass via downgrade attackworkers-oauth-provider | Medium5.3 |
| CVE-2025-4143 | Missing validation of redirect_uri on authorize endpointworkers-oauth-provider | Medium6.0 |
| CVE-2021-3978 | Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpkiCloudflare · octorpki | High7.5 |
| CVE-2025-0651 | File symlink abuse might lead to deleting files belonging to SYSTEM userCloudflare · WARP | Medium6.1 |
| CVE-2024-1410 | Unbounded storage of information related to connection ID retirement, in quicheCloudflare · quiche | Low3.7 |
| CVE-2024-1765 | Unlimited resource allocation by QUIC CRYPTO frames flooding in quicheCloudflare · quiche | Medium5.9 |
| CVE-2024-0212 | Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)Cloudflare · Cloudflare-WordPress | High8.1 |
| CVE-2023-6992 | Memory corruption issues is Cloudflare zlib implementationCloudflare · zlib | Medium4.0 |
| CVE-2023-7080 | Arbitrary remote code execution within wrangler dev Workers sandboxCloudflare · wrangler | High8.5 |
| CVE-2023-7079 | Arbitrary remote file read in Wrangler dev serverCloudflare · wrangler | Medium6.4 |
| CVE-2023-7078 | Server-Side Request Forgery (SSRF) in MiniflareCloudflare · miniflare | High7.5 |
| CVE-2023-6193 | Unbounded queuing of path validation messages in cloudflare-quicheCloudflare · quiche | Medium5.3 |
| CVE-2023-6180 | Resource exhaustion via memory leak in tokio-boringCloudflare · tokio-boring | Medium5.3 |
| CVE-2023-3747 | Insufficient Validation on Override Codes for Always-Enabled WARP ModeCloudflare · WARP Client | Medium5.5 |
| CVE-2023-0654 | Spoofing User's Activity Loads in WARP Mobile Client (Android)Cloudflare · WARP Client | Low3.9 |
| CVE-2023-0238 | Injecting Activity Loads in WARP Mobile ClientCloudflare · WARP Client | Low3.9 |
| CVE-2023-4241 | lol-html panics on certain HTML inputsCloudflare · lol-html | High7.5 |
| CVE-2023-2754 | Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP clientCloudflare · WARP | High7.4 |
| CVE-2023-3766 | Invalid Slice Split Results in Server PanicCloudflare · odoh-rs | Medium5.9 |
| CVE-2023-3348 | Directory traversal vulnerability in Cloudflare WranglerCloudflare · Wrangler | Medium5.7 |
| CVE-2023-1862 | Remote access to warp-svc.exe in Cloudflare WARPCloudflare · WARP Client | High7.3 |
| CVE-2023-3040 | Out of Bounds Access Leading to Undefined BehaviorCloudflare · lua-resty-json | Low3.7 |
| CVE-2023-3036 | Out of Bounds Slice index in cfnts leads to remote panicCloudflare · cfnts | High8.6 |
| CVE-2023-2512 | Buffer under-read in workerdCloudflare · workerd | Medium6.5 |
| CVE-2023-1732 | Improper random reading in CIRCLCloudflare · CIRCL | Medium5.3 |
| CVE-2023-0652 | Local Privilege Escalation in Cloudflare WARP Installer (Windows)Cloudflare · WARP | High7.0 |