Cloudflare Security Advisories — May 2026 — Cloudflare Security Advisories

Cloudflare Security Advisories · May 2026 — Cloudflare Security Advisories

5 advisories 8 CVEs 3 EXPLOITED

Cloudflare CNA advisories (GHSA, blog, changelog) for 2026-05. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 3 are already weaponised in the wild — see the Exploited section.

Back to archive Open Console

Advisories

CFADVISORY-CL-application-security-waf-waf-release-2026-05-20

Changelog2026-05-20

WAF - WAF Release - 2026-05-20

CVEs:CVE-2025-53693

Upstream advisory

CFADVISORY-CL-application-security-waf-waf-release-2026-05-15-emerg

ChangelogExploited2026-05-15

WAF - WAF Release - 2026-05-15 - Emergency

CVEs:CVE-2026-42945

Upstream advisory

CFADVISORY-CL-application-security-workers-waf-waf-and-framework-ad

ChangelogExploited2026-05-07

Workers, WAF - WAF and framework adapter mitigations for React and Next.js vulnerabilities

CVEs:CVE-2025-55184 CVE-2026-23864 CVE-2026-23870

Upstream advisory

CFADVISORY-CL-application-security-waf-waf-release-2026-05-07-emerg

Changelog2026-05-07

WAF - WAF Release - 2026-05-07 - Emergency

CVEs:CVE-2026-44575

Upstream advisory

CFADVISORY-CL-application-security-waf-waf-release-2026-05-04

ChangelogExploited2026-05-04

WAF - WAF Release - 2026-05-04

CVEs:CVE-2026-24423 CVE-2026-39808

Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console