CU
Product
curl
79
CVEs
0
On KEV
9.8
Max CVSS
24
New 30D
Severity mix
Critical 11High 23Medium 13Low 5
Watch
Add curl to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8458 | 6.5 | Jul 3 | wrong reuse for different services Affected: 7.43.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 97c272e5d173ad5f706443e2477f0a84f0044edd before 5e99b73cf441d9c369768b9cd48b5389b9a2503d; 8.20.0; 8.19.0; +34 more |
| CVE-2026-5545 | 6.5 | May 13 | wrong reuse of HTTP Negotiate connection Affected: 7.10.6 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; e56ae1426cb7a0a4a427cf8d6099a821fdaae428 before 33e43985b8f3b9e66691d06e70be0395849856cd; 8.19.0; 8.18.0; +34 more |
| CVE-2024-8096 | 6.5 | Sep 11 | OCSP stapling bypass with GnuTLS Affected: 8.9.1 through 8.9.1; 8.9.0 through 8.9.0; 8.8.0 through 8.8.0; 8.7.1 through 8.7.1; 8.7.0 through 8.7.0; 8.6.0 through 8.6.0; +34 more |
| CVE-2024-7264 | 6.5 | Jul 31 | ASN.1 date parser overread Affected: 8.9.0 through 8.9.0; 8.8.0 through 8.8.0; 8.7.1 through 8.7.1; 8.7.0 through 8.7.0; 8.6.0 through 8.6.0; 8.5.0 through 8.5.0; +34 more |
| CVE-2024-2466 | 6.5 | Mar 27 | TLS certificate check bypass with mbedTLS Affected: 8.6.0 through 8.6.0; 8.5.0 through 8.5.0 |
| CVE-2023-46218 | 6.5 | Dec 7 | This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible Affected: 8.4.0 through 8.4.0 |
| CVE-2024-2379 | 6.3 | Mar 27 | QUIC certificate check bypass with wolfSSL Affected: 8.6.0 through 8.6.0 |
| CVE-2026-6253 | 5.9 | May 13 | proxy credentials leak over redirect-to proxy Affected: 7.14.1 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; 3b60bb725913ce7339aefef0a14b12df4c24db60 before 188c2f166a20fa97c2325b2da7d0e5cecc13725f; 8.19.0; 8.18.0; +34 more |
| CVE-2026-4873 | 5.9 | May 13 | connection reuse ignores TLS requirement Affected: 7.20.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; ec3bb8f727405642a471b4b1b9eb0118fc003104 before 507e7be573b0a76fca597b75ff7cb27a66e7d865; 8.19.0; 8.18.0; +34 more |
| CVE-2026-7168 | 5.3 | May 13 | cross-proxy Digest auth state leak Affected: 7.12.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; fc6eff13b5414caf6edf22d73a3239e074a04216 before c1cfdf59acbaf9504c4578d4cf56cdd7c8594507; 8.19.0; 8.18.0; +34 more |
| CVE-2026-7009 | 5.3 | May 13 | OCSP stapling bypass with Apple SecTrust Affected: 8.19.0 through 8.19.0; 8.18.0 through 8.18.0; 8.17.0 through 8.17.0 |
| CVE-2026-6429 | 5.3 | May 13 | netrc credential leak with reused proxy connection Affected: 7.14.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.0; 01165e08e0d131b399fba2190f17af67e66f0888 before b4024bf808bd558026fdc6096e8457f199ace306; 8.19.0; 8.18.0; +34 more |
| CVE-2023-46219 | 5.3 | Dec 12 | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should… Affected: 8.4.0 through 8.4.0 |
Showing 13