1191 matches found
CVE-2025-66104
CVE-2025-66104 describes a Missing Authorization (Broken Access Control) vulnerability in the WordPress Offload, AI & Optimize with Cloudflare Images cf-images plugin (versions n/a through 1.9.5). The CVSS base metrics indicate attack vector NETWORK, low attack complexity, privileges required LOW...
PT-2025-52217
Name of the Vulnerable Software and Affected Versions Hummingbird Performance plugin for WordPress versions prior to 3.18.1 Description The Hummingbird Performance plugin for WordPress is susceptible to exposure of sensitive information. This affects unauthenticated attackers who can extract data...
WordPress plugin Hummingbird Performance 日志信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A log information...
PT-2025-52200
Missing Authorization vulnerability in Anton Vanyukov Offload, AI & Optimize with Cloudflare Images cf-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Offload, AI & Optimize with Cloudflare Images: from n/a through = 1.9.5...
WordPress plugin Offload, AI & Optimize with Cloudflare Images 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...
Exploit for Deserialization of Untrusted Data in Facebook React
React2Scan !Pythonhttps://img.shields.io/badge/python-3.1...
Exploit for Deserialization of Untrusted Data in Facebook React
⚡ CVE-2025-55182 – Auto Exploit Toolkit Precision Engine...
📄 Cloudflare Memory Leak
A Python-based scanner imitates CloudBleed-style leakage detection by fetching raw HTTP response data from a target website, converting it to hexadecimal, and searching for sensitive memory patterns such as sessions, passwords, tokens, cookies, AWS keys, and stack traces. It does not exploit the...
📄 Cloudbleed Scanner
Cloudbleed Scanner is a comprehensive security tool designed to detect memory leak patterns similar to the 2017 Cloudbleed incident, where Cloudflare's reverse proxies leaked uninitialized memory containing sensitive data...
Cloudflare Has Blocked 416 Billion AI Bot Requests Since July 1
Cloudflare CEO Matthew Prince claims the internet infrastructure company’s efforts to block AI crawlers are already seeing big results...
OPENSUSE-SU-2025:20143-1 Security update for git-bug
This update for git-bug fixes the following issues: Changes in git-bug: - Revendor to include fixed version of depending libraries: - GO-2025-4116 CVE-2025-47913, bsc1253506 upgrade golang.org/x/crypto to v0.43.0 - GO-2025-3900 GHSA-2464-8j7c-4cjm upgrade github.com/go-viper/mapstructure/v2 to...
Record 29.7 Tbps DDoS Attack Linked to AISURU Botnet with up to 4 Million Infected Hosts
Cloudflare on Wednesday said it detected and mitigated the largest ever distributed denial-of-service DDoS attack that measured at 29.7 terabits per second Tbps. The activity, the web infrastructure and security company said, originated from a DDoS botnet-for-hire known as AISURU, which has been...
gokey 安全漏洞
gokey is a Go language library open-sourced by Cloudflare. A security vulnerability exists in gokey versions prior to 0.2.0, which stems from a flaw in the seed decryption logic that could lead to password entropy reduction and password recovery attacks...
EUVD-2025-199280
Malicious code in @trpc-rate-limiter/cloudflare npm...
MAL-2025-191327 Malicious code in @trpc-rate-limiter/cloudflare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f7b0945d5b218d0b4e212ee38448f7de192939870c55e4ef4edb17bfc318d01 The package @trpc-rate-limiter/cloudflare was found to contain malicious code. Source: ghsa-malware...
Insertion of Sensitive Information Into Sent Data
Overview @sentry/cloudflare is an Official Sentry SDK for Cloudflare Workers and Pages Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the sendDefaultPii configuration option. An attacker can gain access to sensitive HTTP headers, such as...
CVE-2025-65019
Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter @astrojs/cloudflare with output: 'server', the image optimization endpoint /image contains a critical vulnerability in the isRemoteAllowed function that unconditionally allows data: protocol URLs. This enable...
WordPress Offload, AI & Optimize with Cloudflare Images plugin <= 1.9.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Offload, AI & Optimize with Cloudflare Images versions = 1.9.5...
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
Summary A Cross-Site Scripting XSS vulnerability exists in Astro when using the @astrojs/cloudflare adapter with output: 'server'. The built-in image optimization endpoint /image uses isRemoteAllowed from Astro’s internal helpers, which unconditionally allows data: URLs. When the endpoint receive...