curl
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| curl | 95 | – | Oct 20, 2026 |
Exploited and recent CVEs
- CVE-2026-107929 local interface connection reuse mixup 0.7%
- CVE-2026-107928 info leak uploading over WebSockets with GnuTLS 0.7%
- CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL 0.6%
- CVE-2026-94265 Authorization: Negotiate sent to foreign origin 0.8%
- CVE-2026-92391 curl_mime_free stack overflow by recursion 1.2%
- CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints 0.6%
- CVE-2026-92389 TFTP direction confusion 0.7%
- CVE-2026-92388 FTP wildcard write callback mixup 0.7%
- CVE-2026-92387 never-ending loop via server response omission 1.0%
- CVE-2026-92386 server-set cookie aborts cookie jar load 0.8%
- CVE-2026-87866 wolfSSL public-key pinning bypass 0.5%
- CVE-2026-87865 knownhost callback mismatches key as missing 0.6%
- CVE-2026-87863 HSTS response erases persisted entries 0.8%
- CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection 0.8%
- CVE-2026-87862 HSTS cache import drops longer-lived child 1.0%
- CVE-2026-87861 cross-origin reuse of a Negotiate connection 0.7%
- CVE-2026-86415 auto client cert connection reuse mixup 0.4%
- CVE-2026-86414 leaking host credentials to HTTP proxy 0.7%
- CVE-2026-86413 Negotiate credentials sent to redirected origin 0.7%
- CVE-2026-86412 server-set cookie erases cookie jar 0.8%
- CVE-2026-86411 FTP connection reuse inherits client-certificate 0.4%
- CVE-2026-86410 redirect to SFTP or SCP bypasses host verification 0.8%
- CVE-2026-86409 stale SigV4 headers sent unintended 1.1%
- CVE-2026-92392 HTTP/2 upload Use-After-Free 1.3%
- CVE-2026-82209 domain-scoped PSL domain cookie 0.4%
- CVE-2026-82208 wolfSSL CA-cache hit overrides callback 0.4%
- CVE-2026-80255 secure cookie attribute bypass with tab 0.5%
- CVE-2026-80231 native CA store conn reuse 0.9%
- CVE-2026-80230 OpenSSL pinning bypass 0.4%
- CVE-2026-80229 OpenSSL provider use-after-free 0.6%