Https
Monthly
Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.
Memory exhaustion in Cloudflare Pingora's HTTP/2 server (versions before 0.8.1) lets a single remote, unauthenticated client drive the process into OOM termination by abusing HPACK header compression and HTTP/2 flow control. Because the h2 crate defaults were left in place, an attacker can emit tiny 1-byte indexed references to an almost-empty header and multiply them into hundreds of thousands of decoded header fields per stream, across an unbounded number of concurrent streams on one connection, exhausting memory (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, CWE-770). The reporter demonstrated a lone connection getting a Pingora process capped at 2 GiB OOM-killed; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the barrier to entry is low for any internet-facing service that terminates h2 or h2c without explicit limits, while Cloudflare CDN customers were unaffected because its internal Pingora services do not front HTTP/2 clients.
Remote code execution in the archived Cloudflare pages-action GitHub Action (src/index.ts) allows network-adjacent attackers to exfiltrate CI/CD secrets - including CLOUDFLARE_API_TOKEN and GITHUB_TOKEN - from affected workflow runner environments. All published versions of cloudflare/pages-action are affected, and Cloudflare has confirmed no patch will be issued because the repository has been deprecated since 2024 and is scheduled for removal on 2026-09-18. No public exploit code has been confirmed at time of analysis, but the vulnerability was discovered and reported through Cloudflare's HackerOne program by external researchers.
SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated attackers extract arbitrary database contents through the 'notinstring' parameter of the wprp_load_more_revs AJAX action. Because the action is exposed via wp_ajax_nopriv and its required nonce is leaked to the frontend through wp_localize_script on any page rendering the plugin shortcode, anyone who can reach a public page hosting the plugin can exploit it. Reported by Wordfence with a CVSS of 7.5; no public exploit identified at time of analysis.
Arbitrary file deletion in the WP Review Slider Pro WordPress plugin (versions up to and including 12.6.8) allows authenticated attackers with Subscriber-level access to delete arbitrary files on the underlying server, potentially escalating to remote code execution by removing files such as wp-config.php to trigger the WordPress setup flow. The flaw stems from missing capability checks on two AJAX handlers (wpfb_hide_review and wprp_save_review_admin) combined with a defective strpos()-based prefix check in wpfb_hidereview_ajax() that fails to neutralize path traversal sequences before calling unlink(). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; reported by Wordfence.
Authenticated SQL injection in the WP Review Slider Pro WordPress plugin through version 12.6.8 lets Subscriber-level users append arbitrary SQL via the wpfb_find_reviews AJAX action, enabling extraction of sensitive database contents including user credentials and secrets. The flaw is reachable by any logged-in WordPress account, which on sites with open registration effectively lowers the bar to near-unauthenticated. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscriber-level access to inject arbitrary SQL via the 'stypes' and 'slocations' JSON parameters of the wppro_get_overall_chart_data AJAX action. Because the vulnerable handler echoes the executed SQL back in its JSON response, attackers gain a built-in oracle that turns blind injection into a near-trivial database extraction primitive. No public exploit identified at time of analysis, but the very low privilege barrier on a default WordPress install makes any exposed site a realistic target.
A request-routing discrepancy in Cloudflare Pingora before 0.9.0 lets an unauthenticated remote attacker send a single HTTP/2 request that the proxy evaluates under one authority while the upstream receives a different Host, so Host-based filters, access controls, or cache keys can be applied to the wrong virtual host. Exploitation is conditional and moderate risk: the deployment must terminate client HTTP/2 in Pingora, make security or caching decisions from the request URI authority, and sit in front of an upstream that routes by Host and serves different content per Host. The outcome is limited-impact confidentiality and integrity exposure on the downstream component (possible cache poisoning or host-based access-control bypass); there is no public exploit code and no confirmed active exploitation at time of analysis, and Cloudflare's own CDN path was unaffected because its internal Pingora services do not accept HTTP/2 from clients.
Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.
Memory exhaustion in Cloudflare Pingora's HTTP/2 server (versions before 0.8.1) lets a single remote, unauthenticated client drive the process into OOM termination by abusing HPACK header compression and HTTP/2 flow control. Because the h2 crate defaults were left in place, an attacker can emit tiny 1-byte indexed references to an almost-empty header and multiply them into hundreds of thousands of decoded header fields per stream, across an unbounded number of concurrent streams on one connection, exhausting memory (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, CWE-770). The reporter demonstrated a lone connection getting a Pingora process capped at 2 GiB OOM-killed; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the barrier to entry is low for any internet-facing service that terminates h2 or h2c without explicit limits, while Cloudflare CDN customers were unaffected because its internal Pingora services do not front HTTP/2 clients.
Remote code execution in the archived Cloudflare pages-action GitHub Action (src/index.ts) allows network-adjacent attackers to exfiltrate CI/CD secrets - including CLOUDFLARE_API_TOKEN and GITHUB_TOKEN - from affected workflow runner environments. All published versions of cloudflare/pages-action are affected, and Cloudflare has confirmed no patch will be issued because the repository has been deprecated since 2024 and is scheduled for removal on 2026-09-18. No public exploit code has been confirmed at time of analysis, but the vulnerability was discovered and reported through Cloudflare's HackerOne program by external researchers.
SQL injection in the WP Review Slider Pro WordPress plugin (versions up to and including 12.7.2) lets unauthenticated attackers extract arbitrary database contents through the 'notinstring' parameter of the wprp_load_more_revs AJAX action. Because the action is exposed via wp_ajax_nopriv and its required nonce is leaked to the frontend through wp_localize_script on any page rendering the plugin shortcode, anyone who can reach a public page hosting the plugin can exploit it. Reported by Wordfence with a CVSS of 7.5; no public exploit identified at time of analysis.
Arbitrary file deletion in the WP Review Slider Pro WordPress plugin (versions up to and including 12.6.8) allows authenticated attackers with Subscriber-level access to delete arbitrary files on the underlying server, potentially escalating to remote code execution by removing files such as wp-config.php to trigger the WordPress setup flow. The flaw stems from missing capability checks on two AJAX handlers (wpfb_hide_review and wprp_save_review_admin) combined with a defective strpos()-based prefix check in wpfb_hidereview_ajax() that fails to neutralize path traversal sequences before calling unlink(). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; reported by Wordfence.
Authenticated SQL injection in the WP Review Slider Pro WordPress plugin through version 12.6.8 lets Subscriber-level users append arbitrary SQL via the wpfb_find_reviews AJAX action, enabling extraction of sensitive database contents including user credentials and secrets. The flaw is reachable by any logged-in WordPress account, which on sites with open registration effectively lowers the bar to near-unauthenticated. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
SQL injection in the WP Review Slider Pro WordPress plugin (versions ≤12.6.8) allows authenticated attackers with Subscriber-level access to inject arbitrary SQL via the 'stypes' and 'slocations' JSON parameters of the wppro_get_overall_chart_data AJAX action. Because the vulnerable handler echoes the executed SQL back in its JSON response, attackers gain a built-in oracle that turns blind injection into a near-trivial database extraction primitive. No public exploit identified at time of analysis, but the very low privilege barrier on a default WordPress install makes any exposed site a realistic target.
A request-routing discrepancy in Cloudflare Pingora before 0.9.0 lets an unauthenticated remote attacker send a single HTTP/2 request that the proxy evaluates under one authority while the upstream receives a different Host, so Host-based filters, access controls, or cache keys can be applied to the wrong virtual host. Exploitation is conditional and moderate risk: the deployment must terminate client HTTP/2 in Pingora, make security or caching decisions from the request URI authority, and sit in front of an upstream that routes by Host and serves different content per Host. The outcome is limited-impact confidentiality and integrity exposure on the downstream component (possible cache poisoning or host-based access-control bypass); there is no public exploit code and no confirmed active exploitation at time of analysis, and Cloudflare's own CDN path was unaffected because its internal Pingora services do not accept HTTP/2 from clients.