WAF benchmark

Name: WAF benchmark: exploited CVEs replayed through vendor WAFs
Creator: Vigilbase
License: https://creativecommons.org/licenses/by/4.0/

The same public exploit requests for 477 exploited CVEs, sent through each vendor's WAF in front of our own test server. Measured, not claimed.

How we test

AWS

Baseline managed rules

25%fully blocked

Blocked 119
Partly 44
Passed 311

0/49 harmless requests blocked · AWS managed rule groups at default actions: Core rule set + Known bad inputs. Regional web ACL on API Gateway (us-east-1)

AWS

All free managed rules

36%fully blocked

Blocked 172
Partly 69
Passed 233

0/49 harmless requests blocked · Every free AWS managed rule group at default actions: Core, Known bad inputs, SQLi, Linux, POSIX, Windows, PHP, WordPress

Cloudflare

Enterprise

32%fully blocked

Blocked 153
Partly 74
Passed 248

0/49 harmless requests blocked · Managed Ruleset + OWASP Core Ruleset (PL1, high sensitivity), Bot Management, BIC on; one managed rule skipped on /api/*

Cloudflare

Free

3%fully blocked

Blocked 16
Partly 6
Passed 452

0/49 harmless requests blocked · Free plan defaults: Free Managed Ruleset, Browser Integrity Check on, no custom rules for this host

Control no WAF

CDN pass-through

1%fully blocked

Blocked 5
Partly 2
Passed 469

0/49 harmless requests blocked · A CDN with no WAF product in front of the same origin. Shows what reaches the origin when nothing filters

Google Cloud

Preconfigured WAF rules

35%fully blocked

Blocked 165
Partly 97
Passed 215

2/49 harmless requests blocked · Global external ALB, 13 preconfigured rules (v33 sets + cve-canary) at sensitivity 1, deny-403

Says it blocks, didn't block

The vendor's changelog lists a rule for the CVE that blocks by default, yet its public exploit request reached our server on every configuration we test. Their rule may target a different request than the public template

Vulnerability	Vendor	In KEV since
PHP Memory Corruption Vulnerability CVE-2026-109618	Cloudflare	2026-10-26	The claim
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-20079	Cloudflare	2026-09-09	The claim
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-82329	Cloudflare	2026-09-02	The claim
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability CVE-2026-1340	Cloudflare	2026-04-08	The claim
React Native Community CLI OS Command Injection Vulnerability CVE-2025-11953	Cloudflare	2026-02-05	The claim
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability CVE-2026-1281	Cloudflare	2026-01-29	The claim
Fortinet FortiWeb Path Traversal Vulnerability CVE-2025-64446	Cloudflare	2025-11-14	The claim
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability CVE-2025-59287	Cloudflare	2025-10-24	The claim
Oracle E-Business Suite Unspecified Vulnerability CVE-2025-61882	Cloudflare	2025-10-06	The claim
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability CVE-2025-20362	Cloudflare	2025-09-25	The claim
Craft CMS Code Injection Vulnerability CVE-2024-56145	Cloudflare	2025-06-02	The claim
SAP NetWeaver Unrestricted File Upload Vulnerability CVE-2025-31324	Cloudflare	2025-04-29	The claim
Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability CVE-2022-43939	Cloudflare	2025-03-03	The claim
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability CVE-2025-0282	Cloudflare	2025-01-08	The claim
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability CVE-2021-44529	Cloudflare	2024-03-25	The claim
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability CVE-2024-21887	Cloudflare	2024-01-10	The claim
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability CVE-2023-46805	Cloudflare	2024-01-10	The claim
Cisco IOS XE Web UI Privilege Escalation Vulnerability CVE-2023-20198	Cloudflare	2023-10-16	The claim
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability CVE-2023-24489	Cloudflare	2023-08-16	The claim
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability CVE-2021-26084	Cloudflare	2021-11-03	The claim

Where they disagree

339 of 477 CVEs: at least one configuration stopped the exploit and another let it through. ● = named in that vendor's changelog

Vulnerability	AWS · Baseline managed rules	AWS · All free managed rules	Cloudflare · Enterprise	Cloudflare · Free	Control no WAF · CDN pass-through	Google Cloud · Preconfigured WAF rules
PHP Memory Corruption Vulnerability CVE-2026-109618	Passed●	Passed●	Passed●	Passed●	Passed	Partly
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability CVE-2026-110447	Partly	Partly	Passed	Passed	Passed	Partly
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CVE-2026-21589	Passed	Passed	Blocked●	Passed●	Passed	Passed
Ahsay AhsayCBS Command Injection Vulnerability CVE-2026-105134	Partly	Partly	Passed	Passed	Passed	Partly
Apache Struts Command Injection Vulnerability CVE-2016-3081	Blocked	Blocked	Blocked	Passed	Passed	Blocked
WordPress Core Remote File Inclusion Vulnerability CVE-2026-87902	Partly	Partly	Partly●	Passed●	Passed	Partly
Check Point Multiple Products Path Traversal Vulnerability CVE-2026-93616	Blocked	Blocked	Passed	Passed	Passed	Blocked
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability CVE-2026-85706	Passed	Passed	Blocked●	Passed●	Passed	Passed
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-42018	Passed	Passed	Partly●	Passed●	Passed	Passed
Sangoma Switchvox SQL Injection Vulnerability CVE-2026-9586	Passed	Passed	Passed	Passed	Passed	Blocked
Gitea Code Injection Vulnerability CVE-2026-60004	Passed	Partly	Passed	Passed	Passed	Partly
MLflow Server-Side Request Forgery Vulnerability CVE-2026-64849	Passed	Passed	Passed	Passed	Passed	Partly
Metabase SQL Injection Vulnerability CVE-2026-72898	Passed	Passed	Passed	Passed	Passed	Partly
Progress LoadMaster Command Injection Vulnerability CVE-2026-8037	Passed	Blocked	Blocked●	Passed●	Passed	Blocked
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability CVE-2026-63077	Partly	Partly	Passed	Passed	Passed	Partly
IBM Langflow Code Injection Vulnerability CVE-2026-9198	Passed	Partly	Passed	Passed	Passed	Partly
WordPress Core Interpretation Conflict Vulnerability CVE-2026-63030	Passed	Passed	Partly●	Partly●	Passed	Passed
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability CVE-2026-0770	Passed	Partly	Partly	Passed	Passed	Partly
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2026-58644	Partly	Partly	Partly	Passed	Passed	Partly
Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808	Passed	Partly	Partly●	Passed●	Passed	Partly
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291	Passed	Passed	Passed	Passed	Passed	Partly
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48939	Passed	Passed	Passed	Passed	Passed	Partly
Joomlack Page Builder Improper Access Control Vulnerability CVE-2026-56290	Passed	Passed	Passed	Passed	Passed	Partly
Adobe ColdFusion Path Traversal Vulnerability CVE-2026-48282	Passed	Passed	Partly●	Passed●	Passed	Passed
Ubiquiti UniFi OS Improper Input Validation Vulnerability CVE-2026-34910	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Ubiquiti UniFi OS Improper Access Control Vulnerability CVE-2026-34908	Partly	Partly	Passed	Passed	Passed	Partly
Widget Factory Joomla Content Editor Improper Access Control Vulnerability CVE-2026-48907	Passed	Passed	Partly	Passed	Passed	Partly
Ivanti Sentry OS Command Injection Vulnerability CVE-2026-10520	Passed	Passed	Blocked●	Passed●	Passed	Passed
Drupal Core SQL Injection Vulnerability CVE-2026-9082	Passed	Partly	Blocked●	Passed●	Passed	Passed
BerriAI LiteLLM SQL Injection Vulnerability CVE-2026-42208	Passed	Partly	Partly	Passed	Passed	Passed
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability CVE-2026-41940	Passed	Passed	Partly●	Passed●	Passed	Passed
D-Link DIR-823X Command Injection Vulnerability CVE-2025-29635	Passed	Partly	Partly	Passed	Passed	Partly
Samsung MagicINFO 9 Server Path Traversal Vulnerability CVE-2024-7399	Partly	Partly	Passed	Passed	Passed	Partly
JetBrains TeamCity Relative Path Traversal Vulnerability CVE-2024-27199	Blocked	Blocked	Passed	Passed	Passed	Blocked
Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197	Passed	Passed	Blocked●	Passed●	Passed	Passed
Fortinet FortiClient EMS SQL Injection Vulnerability CVE-2026-21643	Passed	Partly	Partly●	Passed●	Passed	Passed
Langflow Code Injection Vulnerability CVE-2026-33017	Passed	Partly	Passed	Passed	Passed	Partly
Laravel Livewire Code Injection Vulnerability CVE-2025-54068	Passed	Partly	Passed	Passed	Passed	Partly
Craft CMS Code Injection Vulnerability CVE-2025-32432	Passed	Passed	Partly●	Passed●	Passed	Passed
n8n Improper Control of Dynamically-Managed Code Resources Vulnerability CVE-2025-68613	Passed	Passed	Passed	Passed	Passed	Partly
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability CVE-2026-1603	Passed	Passed	Passed	Passed	Passed	Blocked
Omnissa Workspace ONE Server-Side Request Forgery CVE-2021-22054	Passed	Passed	Blocked	Passed	Passed	Passed
RoundCube Webmail Deserialization of Untrusted Data Vulnerability CVE-2025-49113	Partly	Partly	Partly●	Passed●	Passed	Partly
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability CVE-2026-24423	Passed	Passed	Blocked●	Passed●	Passed	Passed
Sangoma FreePBX OS Command Injection Vulnerability CVE-2025-64328	Partly	Blocked	Partly	Passed	Passed	Partly
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability CVE-2025-40551	Passed	Passed	Passed	Passed	Passed	Partly
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-23760	Passed	Passed	Blocked●	Passed●	Passed	Blocked
SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2025-52691	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability CVE-2025-68645	Passed	Blocked	Blocked●	Passed●	Passed	Passed
Versa Concerto Improper Authentication Vulnerability CVE-2025-34026	Passed	Passed	Blocked●	Passed●	Passed	Passed
Vite Vitejs Improper Access Control Vulnerability CVE-2025-31125	Partly	Blocked	Blocked●	Partly●	Passed	Partly
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability CVE-2025-14611	Blocked	Blocked	Passed	Passed	Passed	Passed
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-58360	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Meta React Server Components Remote Code Execution Vulnerability CVE-2025-55182	Blocked	Blocked	Blocked●	Blocked●	Passed	Blocked●
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability CVE-2025-61757	Passed	Passed	Partly●	Passed●	Passed	Passed
Fortinet FortiWeb Path Traversal Vulnerability CVE-2025-64446	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
CWP Control Web Panel OS Command Injection Vulnerability CVE-2025-48703	Passed	Passed	Partly●	Passed●	Passed	Partly
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability CVE-2025-11371	Blocked	Blocked	Blocked	Passed	Passed	Blocked
XWiki Platform Eval Injection Vulnerability CVE-2025-24893	Passed	Blocked	Blocked●	Passed●	Passed	Blocked
Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability CVE-2025-6205	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Dassault Systèmes DELMIA Apriso Code Injection Vulnerability CVE-2025-6204	Partly	Partly	Partly	Passed	Passed	Partly
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability CVE-2025-59287	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
Adobe Commerce and Magento Improper Input Validation Vulnerability CVE-2025-54236	Passed	Passed	Blocked●	Passed●	Passed	Blocked
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability CVE-2025-61884	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2747	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2025-2746	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Oracle E-Business Suite Unspecified Vulnerability CVE-2025-61882	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
Smartbedded Meteobridge Command Injection Vulnerability CVE-2025-4008	Passed	Blocked	Blocked	Passed	Passed	Blocked
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability CVE-2025-10035	Passed	Passed	Partly●	Passed●	Passed	Passed
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability CVE-2025-20362	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data Vulnerability CVE-2025-5086	Blocked	Blocked	Passed	Passed	Passed	Blocked
Sangoma FreePBX Authentication Bypass Vulnerability CVE-2025-57819	Passed	Partly	Partly	Passed	Passed	Partly
Cisco Identity Services Engine Injection Vulnerability CVE-2025-20281	Passed	Blocked	Blocked●	Passed●	Passed	Blocked
Microsoft SharePoint Improper Authentication Vulnerability CVE-2025-49706	Passed	Passed	Blocked	Passed	Passed	Passed
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-2776	Blocked	Blocked	Blocked	Passed	Passed	Blocked
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability CVE-2025-2775	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability CVE-2025-53770	Passed	Passed	Blocked●	Passed●	Passed	Passed
Fortinet FortiWeb SQL Injection Vulnerability CVE-2025-25257	Passed	Passed	Blocked●	Passed●	Passed	Passed
Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability CVE-2025-47812	Passed	Partly	Partly●	Passed●	Passed	Partly
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability CVE-2019-9621	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Rails Ruby on Rails Path Traversal Vulnerability CVE-2019-5418	Passed	Blocked	Blocked	Passed	Passed	Blocked
Wazuh Server Deserialization of Untrusted Data Vulnerability CVE-2025-24016	Passed	Passed	Partly●	Passed●	Passed	Passed
Samsung MagicINFO 9 Server Path Traversal Vulnerability CVE-2025-4632	Partly	Partly	Passed	Passed	Passed	Partly
Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability CVE-2025-4427	Blocked	Blocked	Blocked●	Blocked●	Passed	Blocked
ZKTeco BioTime Path Traversal Vulnerability CVE-2023-38950	Blocked	Blocked	Passed	Passed	Passed	Blocked
DrayTek Vigor Routers OS Command Injection Vulnerability CVE-2024-12987	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Langflow Missing Authentication Vulnerability CVE-2025-3248	Passed	Blocked	Blocked●	Passed●	Passed	Blocked
Commvault Command Center Path Traversal Vulnerability CVE-2025-34028	Passed	Passed	Blocked●	Passed●	Passed	Passed
Apache HTTP Server Improper Escaping of Output Vulnerability CVE-2024-38475	Partly	Partly	Partly●	Passed●	Passed	Passed
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability CVE-2025-30406	Blocked	Blocked	Passed	Passed	Passed	Passed
Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813	Passed	Passed	Partly●	Passed●	Passed	Partly
NAKIVO Backup and Replication Absolute Path Traversal Vulnerability CVE-2024-48248	Passed	Blocked	Blocked●	Passed●	Passed	Blocked
SAP NetWeaver Directory Traversal Vulnerability CVE-2017-12637	Passed	Passed	Passed	Passed	Passed	Blocked
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability CVE-2024-13161	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability CVE-2024-13160	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability CVE-2024-13159	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Progress WhatsUp Gold Path Traversal Vulnerability CVE-2024-4885	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability CVE-2022-43769	Blocked	Blocked	Blocked●	Passed●	Passed	Passed
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2023-34192	Partly	Partly	Partly	Passed	Passed	Partly
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability CVE-2025-0108	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability CVE-2024-53704	Passed	Passed	Blocked●	Passed●	Passed	Passed
SimpleHelp Path Traversal Vulnerability CVE-2024-57727	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Microsoft .NET Framework Information Disclosure Vulnerability CVE-2024-29059	Partly	Partly	Passed	Passed	Passed	Partly
Aviatrix Controllers OS Command Injection Vulnerability CVE-2024-50603	Passed	Blocked	Blocked●	Passed●	Passed	Blocked
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2024-55591	Passed	Passed	Partly●	Passed●	Passed	Passed
Mitel MiCollab Path Traversal Vulnerability CVE-2024-55550	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Mitel MiCollab Path Traversal Vulnerability CVE-2024-41713	Blocked	Blocked	Blocked●	Passed●	Passed	Blocked
Cleo Multiple Products Unauthenticated File Upload Vulnerability CVE-2024-55956	Passed	Passed	Blocked●	Passed●	Passed	Passed
Adobe ColdFusion Improper Access Control Vulnerability CVE-2024-20767	Partly	Partly	Passed	Passed	Passed	Partly
Cleo Multiple Products Unrestricted File Upload Vulnerability CVE-2024-50623	Passed	Partly	Partly	Passed	Passed	Partly
CyberPanel Incorrect Default Permissions Vulnerability CVE-2024-51378	Passed	Passed	Partly●	Passed●	Passed	Passed
ProjectSend Improper Authentication Vulnerability CVE-2024-11680	Passed	Passed	Partly●	Passed●	Passed	Passed
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability CVE-2024-9474	Passed	Passed	Blocked●	Passed●	Passed	Partly
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability CVE-2024-0012	Passed	Passed	Blocked●	Passed●	Passed	Passed
Palo Alto Networks Expedition SQL Injection Vulnerability CVE-2024-9465	Passed	Partly	Partly	Passed	Passed	Partly
Palo Alto Networks Expedition OS Command Injection Vulnerability CVE-2024-9463	Passed	Passed	Passed	Passed	Passed	Blocked
Metabase GeoJSON API Local File Inclusion Vulnerability CVE-2021-41277	Partly	Blocked	Passed	Passed	Passed	Partly
Atlassian Jira Server and Data Center Path Traversal Vulnerability CVE-2021-26086	Blocked	Blocked	Blocked	Passed	Passed	Passed
Palo Alto Networks Expedition Missing Authentication Vulnerability CVE-2024-5910	Passed	Passed	Blocked	Passed	Passed	Passed
CyberPanel Incorrect Default Permissions Vulnerability CVE-2024-51567	Passed	Partly	Partly●	Passed●	Passed	Partly
Nostromo nhttpd Directory Traversal Vulnerability CVE-2019-16278	Passed	Blocked	Blocked	Passed	Passed	Blocked
SolarWinds Web Help Desk Hardcoded Credential Vulnerability CVE-2024-28987	Passed	Passed	Blocked	Passed	Passed	Passed
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability CVE-2024-29824	Blocked	Blocked	Blocked	Passed	Passed	Blocked
D-Link DIR-820 Router OS Command Injection Vulnerability CVE-2023-25280	Passed	Partly	Passed	Passed	Passed	Partly
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability CVE-2020-15415	Passed	Blocked	Passed	Passed	Passed	Blocked
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability CVE-2024-7593	Passed	Passed	Partly	Passed	Passed	Partly
Apache HugeGraph-Server Improper Access Control Vulnerability CVE-2024-27348	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Progress WhatsUp Gold SQL Injection Vulnerability CVE-2024-6670	Passed	Partly	Partly	Passed	Passed	Partly
Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20124	Blocked	Blocked	Passed	Passed	Passed	Blocked
Draytek VigorConnect Path Traversal Vulnerability CVE-2021-20123	Blocked	Blocked	Passed	Passed	Passed	Blocked
Apache OFBiz Incorrect Authorization Vulnerability CVE-2024-38856	Passed	Passed	Blocked	Passed	Passed	Passed
Dahua IP Camera Authentication Bypass Vulnerability CVE-2021-33045	Passed	Passed	Passed	Passed	Passed	Blocked
Apache OFBiz Path Traversal Vulnerability CVE-2024-32113	Passed	Passed	Blocked	Passed	Passed	Blocked
ServiceNow Incomplete List of Disallowed Inputs Vulnerability CVE-2024-5217	Blocked	Blocked	Blocked	Passed	Passed	Blocked
ServiceNow Improper Input Validation Vulnerability CVE-2024-4879	Blocked	Blocked	Passed	Passed	Passed	Blocked
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability CVE-2024-34102	Passed	Passed	Blocked●	Passed●	Passed	Passed
SolarWinds Serv-U Path Traversal Vulnerability CVE-2024-28995	Blocked	Blocked	Passed	Passed	Passed	Blocked
OSGeo GeoServer GeoTools Eval Injection Vulnerability CVE-2024-36401	Partly	Partly	Partly	Passed	Passed	Partly
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2024-23692	Blocked	Blocked	Passed	Passed	Passed	Blocked
OSGeo GeoServer JAI-EXT Code Injection Vulnerability CVE-2022-24816	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability CVE-2024-4358	Passed	Passed	Partly	Passed	Passed	Passed
PHP-CGI OS Command Injection Vulnerability CVE-2024-4577	Passed	Blocked	Blocked	Passed	Passed	Blocked
Oracle WebLogic Server OS Command Injection Vulnerability CVE-2017-3506	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Check Point Quantum Security Gateways Information Disclosure Vulnerability CVE-2024-24919	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Apache Flink Improper Access Control Vulnerability CVE-2020-17519	Blocked	Blocked	Passed	Passed	Passed	Blocked
NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability CVE-2023-43208	Partly	Partly	Partly	Passed	Passed	Partly
CrushFTP VFS Sandbox Escape Vulnerability CVE-2024-4040	Partly	Partly	Passed	Passed	Passed	Partly
Palo Alto Networks PAN-OS Command Injection Vulnerability CVE-2024-3400	Passed	Partly	Passed	Passed	Passed	Partly
Nice Linear eMerge E3-Series OS Command Injection Vulnerability CVE-2019-7256	Passed	Partly	Passed	Passed	Passed	Partly
JetBrains TeamCity Authentication Bypass Vulnerability CVE-2024-27198	Passed	Passed	Blocked	Passed	Passed	Passed
Sunhillo SureLine OS Command Injection Vulnerablity CVE-2021-36380	Passed	Blocked	Passed	Passed	Passed	Blocked
ConnectWise ScreenConnect Authentication Bypass Vulnerability CVE-2024-1709	Passed	Passed	Blocked	Passed	Passed	Passed
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability CVE-2024-21893	Blocked	Blocked	Passed	Passed	Passed	Blocked
Atlassian Confluence Data Center and Server Template Injection Vulnerability CVE-2023-22527	Passed	Blocked	Blocked	Passed	Passed	Blocked
VMware vCenter Server Out-of-Bounds Write Vulnerability CVE-2023-34048	Partly	Partly	Passed	Passed	Passed	Partly
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability CVE-2023-35082	Passed	Passed	Blocked	Passed	Passed	Passed
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability CVE-2024-21887	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability CVE-2023-46805	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-38203	Passed	Passed	Blocked	Passed	Passed	Passed
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-29300	Passed	Passed	Blocked	Passed	Passed	Passed
Joomla! Improper Access Control Vulnerability CVE-2023-23752	Passed	Passed	Partly	Passed	Passed	Passed
Qlik Sense Path Traversal Vulnerability CVE-2023-41266	Blocked	Blocked	Passed	Passed	Passed	Blocked
Sophos Web Appliance Command Injection Vulnerability CVE-2023-1671	Passed	Passed	Blocked	Passed	Passed	Passed
SysAid Server Path Traversal Vulnerability CVE-2023-47246	Partly	Partly	Partly	Passed	Passed	Partly
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability CVE-2023-36845	Passed	Blocked	Blocked	Passed	Passed	Blocked
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability CVE-2023-36844	Passed	Passed	Partly	Passed	Passed	Partly
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability CVE-2023-22518	Blocked●	Blocked●	Blocked	Passed	Passed	Blocked
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability CVE-2023-4966	Passed	Passed	Partly●	Passed●	Passed	Passed
Cisco IOS XE Web UI Privilege Escalation Vulnerability CVE-2023-20198	Blocked	Blocked	Passed●	Passed●	Passed	Blocked
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability CVE-2023-40044	Passed	Passed	Blocked	Passed	Passed	Passed
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability CVE-2023-22515	Partly●	Partly●	Partly	Partly	Passed	Passed
JetBrains TeamCity Authentication Bypass Vulnerability CVE-2023-42793	Passed	Passed	Partly	Passed	Passed	Partly
Laravel Ignition File Upload Vulnerability CVE-2021-3129	Partly	Partly	Passed	Passed	Passed	Partly
Ivanti Sentry Authentication Bypass Vulnerability CVE-2023-38035	Passed	Passed	Blocked	Passed	Passed	Passed
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2023-37580	Partly	Partly	Partly	Passed	Passed	Partly
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability CVE-2023-35078	Passed	Passed	Blocked	Passed	Passed	Passed
SolarView Compact Command Injection Vulnerability CVE-2022-29303	Passed	Blocked	Blocked	Passed	Passed	Blocked
Vmware Aria Operations for Networks Command Injection Vulnerability CVE-2023-20887	Passed	Passed	Blocked	Passed	Passed	Blocked
Roundcube Webmail Remote Code Execution Vulnerability CVE-2020-12641	Passed	Blocked	Passed	Passed	Passed	Passed
Progress MOVEit Transfer SQL Injection Vulnerability CVE-2023-34362	Passed	Passed	Partly	Passed	Passed	Passed
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability CVE-2023-25717	Passed	Passed	Passed	Passed	Passed	Blocked
TP-Link Archer AX-21 Command Injection Vulnerability CVE-2023-1389	Passed	Blocked	Passed	Passed	Passed	Blocked
Apache Log4j2 Deserialization of Untrusted Data Vulnerability CVE-2021-45046	Blocked	Blocked	Blocked	Blocked	Passed	Blocked●
MinIO Information Disclosure Vulnerability CVE-2023-28432	Passed	Passed	Blocked	Passed	Passed	Passed
PaperCut MF/NG Improper Access Control Vulnerability CVE-2023-27350	Partly	Partly	Partly	Passed	Partly	Partly
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2022-27926	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-26360	Blocked	Blocked	Blocked	Passed	Passed	Blocked
XStream Remote Code Execution Vulnerability CVE-2021-39144	Blocked	Blocked	Blocked	Passed	Passed	Blocked
Teclib GLPI Remote Code Execution Vulnerability CVE-2022-35914	Passed	Blocked	Blocked	Passed	Passed	Blocked
Apache Spark Command Injection Vulnerability CVE-2022-33891	Blocked	Blocked	Blocked	Passed	Passed	Blocked
ZK Framework AuUploader Unspecified Vulnerability CVE-2022-36537	Passed	Passed	Partly	Passed	Passed	Partly
IBM Aspera Faspex Code Execution Vulnerability CVE-2022-47986	Passed	Passed	Blocked	Passed	Passed	Passed
Cacti Command Injection Vulnerability CVE-2022-46169	Passed	Passed	Passed	Passed	Passed	Blocked
Fortra GoAnywhere MFT Remote Code Execution Vulnerability CVE-2023-0669	Passed	Passed	Blocked	Passed	Passed	Passed
Multiple SugarCRM Products Remote Code Execution Vulnerability CVE-2023-22952	Passed	Passed	Passed	Passed	Passed	Partly
Oracle E-Business Suite Unspecified Vulnerability CVE-2022-21587	Passed	Passed	Partly	Passed	Passed	Partly
CWP Control Web Panel OS Command Injection Vulnerability CVE-2022-44877	Blocked	Blocked	Blocked	Passed	Passed	Blocked
TIBCO JasperReports Library Directory Traversal Vulnerability CVE-2018-18809	Blocked	Blocked	Passed	Passed	Passed	Blocked
Fortinet Multiple Products Authentication Bypass Vulnerability CVE-2022-40684	Passed	Passed	Partly●	Passed●	Passed	Partly
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability CVE-2022-36804	Passed	Passed	Partly	Passed	Passed	Passed

Every CVE and every request: JSON · Markdown

How we test

Same requests for everyone. Each CVE's public exploit request from nuclei-templates, built byte for byte the same way for every target, plus about 30 ordinary requests (page views, searches, JSON and form posts, a file upload) to count false positives.
Our own server, nothing vulnerable. Every WAF sits in front of the same origin, which runs nothing and marks every response it serves. A response without that mark came from the WAF. Blocked, challenged or refused by the edge counts as stopped.
Configurations as shipped. Each target lists exactly what is switched on. We don't tune for the test; a tuned WAF will do better than these numbers.
Polite. One request per second per target, a few thousand a day at most, and only to hostnames we run. No payloads are republished on this site.
Reproducible. The request list, templates commit and every target's configuration are in the JSON.
Who runs it. Vigilbase. We are a Cloudflare partner and sell managed Cloudflare, so treat our reading with that in mind and check the raw results. Vendors can send us a configuration they'd rather we test.

Defaults leave gaps

Every configuration above misses some exploited CVEs. Tuning and watching the WAF closes them.

Vigilbase Shield

Managed Cloudflare WAF on a monthly plan.

Managed Cloudflare WAF and DDoS protection on a monthly plan, run by our team.

See Shield plans

Managed Cloudflare

Cloudflare Enterprise, run and tuned by Vigilbase.

Cloudflare Enterprise licensing, with Vigilbase running the account: changes, tuning and verification.

Managed Cloudflare

Vigilbase OS

Know the day a CVE like these reaches your stack.

Connects the security tools you already pay for. Vigil investigates, makes the fixes you authorise and verifies them.

Get started