CU
Vendor
curl
85
CVEs
0
On KEV
24
New 30D
Products
CU9.8
curl
curl
79 CVEs0 on KEV24 new
LI6.5
Libcurl
Curl
5 CVEs0 on KEV0 new
WC4.6
Wcurl
Curl
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107929 | CU curl curl | – | Oct 20 | local interface connection reuse mixup |
| CVE-2026-107928 | CU curl curl | – | Oct 20 | info leak uploading over WebSockets with GnuTLS |
| CVE-2026-94266 | CU curl curl | – | Oct 20 | password leak in CURLINFO_EFFECTIVE_URL |
| CVE-2026-94265 | CU curl curl | – | Oct 20 | Authorization: Negotiate sent to foreign origin |
| CVE-2026-92391 | CU curl curl | – | Oct 20 | curl_mime_free stack overflow by recursion |
| CVE-2026-92390 | CU curl curl | – | Oct 20 | -J no-clobber guarantee bypassed with 103 early hints |
| CVE-2026-92389 | CU curl curl | – | Oct 20 | TFTP direction confusion |
| CVE-2026-92388 | CU curl curl | – | Oct 20 | FTP wildcard write callback mixup |
| CVE-2026-92387 | CU curl curl | – | Oct 20 | never-ending loop via server response omission |
| CVE-2026-92386 | CU curl curl | – | Oct 20 | server-set cookie aborts cookie jar load |
| CVE-2026-87866 | CU curl curl | – | Oct 20 | wolfSSL public-key pinning bypass |
| CVE-2026-87865 | CU curl curl | – | Oct 20 | knownhost callback mismatches key as missing |
| CVE-2026-87863 | CU curl curl | – | Oct 20 | HSTS response erases persisted entries |
| CVE-2026-87864 | CU curl curl | – | Oct 20 | IMAP APPEND plus CRLF conversion command injection |
| CVE-2026-87862 | CU curl curl | – | Oct 20 | HSTS cache import drops longer-lived child |
| CVE-2026-87861 | CU curl curl | – | Oct 20 | cross-origin reuse of a Negotiate connection |
| CVE-2026-86415 | CU curl curl | – | Oct 20 | auto client cert connection reuse mixup |
| CVE-2026-86414 | CU curl curl | – | Oct 20 | leaking host credentials to HTTP proxy |
| CVE-2026-86413 | CU curl curl | – | Oct 20 | Negotiate credentials sent to redirected origin |
| CVE-2026-86412 | CU curl curl | – | Oct 20 | server-set cookie erases cookie jar |
| CVE-2026-86411 | CU curl curl | – | Oct 20 | FTP connection reuse inherits client-certificate |
| CVE-2026-86410 | CU curl curl | – | Oct 20 | redirect to SFTP or SCP bypasses host verification |
| CVE-2026-86409 | CU curl curl | – | Oct 20 | stale SigV4 headers sent unintended |
| CVE-2026-92392 | CU curl curl | 8.1 | Oct 14 | HTTP/2 upload Use-After-Free |
| CVE-2026-82209 | CU curl curl | 8.2 | Sep 6 | domain-scoped PSL domain cookie |
| CVE-2026-82208 | CU curl curl | 7.5 | Sep 6 | wolfSSL CA-cache hit overrides callback |
| CVE-2026-80255 | CU curl curl | 7.5 | Sep 6 | secure cookie attribute bypass with tab |
| CVE-2026-80231 | CU curl curl | 7.5 | Sep 6 | native CA store conn reuse |
| CVE-2026-80230 | CU curl curl | 7.5 | Sep 6 | OpenSSL pinning bypass |
| CVE-2026-80229 | CU curl curl | 7.5 | Sep 6 | OpenSSL provider use-after-free |
| CVE-2026-19931 | CU curl curl | 9.8 | Sep 6 | Negotiate ambient user conn reuse |
| CVE-2026-18924 | CU curl curl | 9.1 | Sep 6 | HTTP/2 server push UAF |
| CVE-2026-13608 | CU curl curl | 7.4 | Sep 6 | OpenLDAP SASL authentication bypass |
| CVE-2026-9547 | CU curl curl | 7.4 | Jul 3 | SSH improper host validation |
| CVE-2026-9546 | CU curl curl | 7.5 | Jul 3 | sending old referer |
| CVE-2026-9545 | CU curl curl | 7.5 | Jul 3 | exposing HTTP/3 early data |
| CVE-2026-9080 | CU curl curl | 7.3 | Jul 3 | UAF after pause in socket callback |
| CVE-2026-9079 | CU curl curl | 9.8 | Jul 3 | stale proxy password leak |
| CVE-2026-8932 | CU curl curl | 7.5 | Jul 3 | incomplete mTLS config matching in conn reuse |
| CVE-2026-8927 | CU curl curl | 9.1 | Jul 3 | env-set cross-proxy Digest auth state leak |
| CVE-2026-8926 | CU curl curl | 9.1 | Jul 3 | password leak with netrc and user in URL |
| CVE-2026-8925 | CU curl curl | 9.8 | Jul 3 | SASL double-free |
| CVE-2026-8924 | CU curl curl | 9.1 | Jul 3 | trailing dot domain super cookie |
| CVE-2026-8458 | CU curl curl | 6.5 | Jul 3 | wrong reuse for different services |
| CVE-2026-8286 | CU curl curl | 8.1 | Jul 3 | wrong STARTTLS connection reuse |
| CVE-2026-12064 | CU curl curl | 7.5 | Jul 3 | proto-default skips SSH verification |
| CVE-2026-11856 | CU curl curl | 9.8 | Jul 3 | cross-origin Digest auth state leak |
| CVE-2026-11586 | CU curl curl | 7.5 | Jul 3 | WS Auto-PONG memory exhaustion |
| CVE-2026-11564 | CU curl curl | 9.1 | Jul 3 | Native CA trust persist |
| CVE-2026-11352 | CU curl curl | 7.5 | Jul 3 | QUIC zero-length UDP datagrams busy-loop |
| CVE-2026-10536 | CU curl curl | 9.8 | Jul 3 | HTTP/2 stream-dependency tree UAF |
| CVE-2026-7168 | CU curl curl | 5.3 | May 13 | cross-proxy Digest auth state leak |
| CVE-2026-7009 | CU curl curl | 5.3 | May 13 | OCSP stapling bypass with Apple SecTrust |
| CVE-2026-6429 | CU curl curl | 5.3 | May 13 | netrc credential leak with reused proxy connection |
| CVE-2026-6276 | CU curl curl | 7.5 | May 13 | stale custom cookie host causes cookie leak |
| CVE-2026-6253 | CU curl curl | 5.9 | May 13 | proxy credentials leak over redirect-to proxy |
| CVE-2026-5773 | CU curl curl | 7.5 | May 13 | wrong reuse of SMB connection |
| CVE-2026-5545 | CU curl curl | 6.5 | May 13 | wrong reuse of HTTP Negotiate connection |
| CVE-2026-4873 | CU curl curl | 5.9 | May 13 | connection reuse ignores TLS requirement |
| CVE-2025-11563 | WC Wcurl Curl | 4.6 | Feb 25 | URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it |