How many CVEs does cloudflare have?

cloudflare has 70 published CVE records since 2020, including 24 in the last two years.

How many cloudflare CVEs are in CISA KEV?

None of cloudflare's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which cloudflare products have the most CVEs?

The cloudflare products with the most published CVEs are WARP, cfrpki, quiche, octorpki, github.com/cloudflare/cfrpki.

What are the most common weakness types in cloudflare CVEs?

cloudflare's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-862 (Missing Authorization), CWE-770 (Allocation of Resources Without Limits or Throttling).

How many critical cloudflare vulnerabilities are there?

cloudflare has 6 critical and 41 high-severity CVEs.

What is the average severity of cloudflare CVEs?

The average CVSS base score across cloudflare's scored CVEs is 7.2.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Home
Vendors
Cloudflare

RadicalNotion.AI

We do not sell or share your personal information

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Careers
Contact
Book a demo

Get Started

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Home
Vendors
Cloudflare

cloudflare Vulnerabilities: CVEs, CISA KEV & Security Advisories

70 CVEs

cloudflare Vulnerabilities

Name: cloudflare vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for cloudflare.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.2

Avg CVSS

2020–2026

Overview

cloudflare has 70 published CVE records since 2020, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting cloudflare products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on cloudflare's vulnerability posture, as a share of its 70 published CVEs.

Average CVSS: 7.2
Critical / high: 67%
Actively exploited (KEV): 0%
Public exploit available: 3%
Patch available: 99%

Severity and exploitation

How the CVSS severity of cloudflare's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High41

Medium20

Low3

In CISA’s Known Exploited Vulnerabilities catalog

None of cloudflare's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2 of cloudflare's CVEs have a known public exploit available.

Most affected products

The cloudflare products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

WARP19 CVEs
cfrpki9 CVEs
quiche9 CVEs
octorpki9 CVEs
github.com/cloudflare/cfrpki9 CVEs
workers-sdk6 CVEs
WARP Client4 CVEs

Common weakness types

The CWE weakness categories most often found in cloudflare CVEs. Follow any weakness for its full explanation.

CWE-20Improper Input Validation8 CVEs
CWE-400Uncontrolled Resource Consumption7 CVEs
CWE-862Missing Authorization5 CVEs
CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')3 CVEs

CNAs that assign these CVEs

The CVE Numbering Authorities that publish cloudflare CVE records.

cloudflare67 CVEs
redhat1 CVEs
GitHub_M1 CVEs
Go1 CVEs

Disclosure activity by year

How many cloudflare CVEs were published each year.

2020

2021

2022

2023

2024

2025

2026

Latest cloudflare CVEs

The most recently disclosed vulnerabilities affecting cloudflare.

cloudflare/pages-action is deprecated — migration required by September 18th, 2026
CWE-78
High · CVSS 8.8
EPSS 0.5%2026-08-12
Resource exhaustion in quiche HTTP/3 and QPACK layers
CWE-400
High · CVSS 7.5
EPSS 0.5%2026-07-14
Unbounded path event queue growth in quiche via peer-driven source connection ID rotation
CWE-770
High · CVSS 7.5
EPSS 0.4%2026-07-14
Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,673 CVEs linux22,774 CVEs Google16,481 CVEs Apple15,095 CVEs Oracle12,708 CVEs Debian10,226 CVEs IBM8,839 CVEs Red Hat8,111 CVEs

Browse all vendors

Frequently asked questions

Common questions about cloudflare vulnerabilities.

How many CVEs does cloudflare have?: cloudflare has 70 published CVE records since 2020, including 24 in the last two years.
How many cloudflare CVEs are in CISA KEV?: None of cloudflare's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which cloudflare products have the most CVEs?: The cloudflare products with the most published CVEs are WARP, cfrpki, quiche, octorpki, github.com/cloudflare/cfrpki.
What are the most common weakness types in cloudflare CVEs?: cloudflare's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-862 (Missing Authorization), CWE-770 (Allocation of Resources Without Limits or Throttling).
Are there public exploits for cloudflare vulnerabilities?: Yes — 2 of cloudflare's CVEs have a known public exploit.
How many critical cloudflare vulnerabilities are there?: cloudflare has 6 critical and 41 high-severity CVEs.
What is the average severity of cloudflare CVEs?: The average CVSS base score across cloudflare's scored CVEs is 7.2.