Represented by Carahsoft ↗, Exclusive Networks ↗, Optiv ↗
No description recorded yet for Cloudflare.
Tools & products
Read by an AI model from cloudflare.com’s own pages. What the vendor says it does, not independently verified.
Integrates with: Autonomous Security ↗, CrowdStrike ↗, Egress ↗, Microsoft ↗, Ocean ↗, Oracle ↗, Resolver ↗, SentinelOne
4 of 5 independent trust signals established
Cloudflare has 4 dimensions with established evidence. The rest have not been confirmed yet.
Not yet established: Independently verified
Has anyone other than the vendor confirmed this?
Nothing here has been confirmed by an independent third party yet.
Is this a real, durable business?
How long this vendor has been operating, and who stands behind them.
Security headers (5/5) — checked 10/18/2026
Infrastructure & transparency signals
9 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cac…
BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as…
Not a quality rating or endorsement — a measure of how much verified, disclosed data we actually have about this vendor. A low score usually means "we don't have much verified information yet," not "this is a bad vendor." Never used to sort or rank vendor lists.
The platform admin controls the formula's weights.
Product information on this page is auto-generated by 0-Doubt from public sources and not yet confirmed by the vendor or an independent analyst, unless an item is individually labelled otherwise. How trust works →
Integrated by: Andesite, Approov, Arize AI, Bastion, Bitwarden, Blackpoint Cyber, Blink Ops, Bolster, CHEQ, Cakewalk, Clarity Security, CloudDefense.AI, Complyan, Complyance, Compyl, ConductorOne, Coralogix, Cotool, Credas, CrowdSec, CrowdStrike, Cybervergent, Cypago, DNSFilter, Darwinium, DataBahn, Daylight Security, Detectify, Discern Security, Drata, EasyDMARC, Elastic, Entitle, Exaforce, Expel, Fastly, Fencer, FusionAuth, Grip Security, Gurucul, Hackuity, Hadrian, Halo Security, Huntbase, Indusface, Infisical, InstaSafe Technologies, Intezer, Intruder, Invary, Keepnet Labs, Kentik, Kertos, Konvu, Lasso Security, Mitigata, Moxso, Mycroft, Nagomi Security, Neeve, Netacea, Nudge Security, Obsidian Security, OctoXLabs, Offroad, Oleria, Ory Corp, Panther, Permiso, Portal26, Reach Security, Reco, Red Canary, Red Sift, RunReveal, Safe Security, SafeBase, SailPoint, Scytale, Seceon Inc, Seraphic, Sola Security, StrangeBee, Stream.Security, Stytch, TCPWave, Tenable, Tenzir, ThreatAware, ThreatDefence, Trustle, Tuskira, Twingate, UncommonX, UpGuard, Upwind, Valimail, Vamu, Vanta, Wallarm, Wazuh, Wiz, ZEST Security, Zynap, eperi, iVerify, mondoo, myra security, prove, torii
What do they do when something goes wrong?
What their public record shows about handling vulnerabilities and outages.
Do they tell you the awkward things unprompted?
How much this vendor volunteers before you have to ask.
Are they still shipping, or coasting?
Whether this vendor is visibly still building.
Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft …
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its…
An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any c…
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. …
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. …
Rejected reason: This CVE ID is a duplicate of CVE-2026-39749 and was never published. Both IDs were assigned to the same Broken Access Control vulnerability in the App for Cloudflare WordPress plugin…
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attacke…
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience…
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlle…
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validat…
Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications us…
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), …
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, …
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query …
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting…
Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() …
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain…
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying…
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to st…
Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connecti…