Vulnerabilities in CURL
98 resultsCVE-2026-18924CRITICALHTTP/2 server push UAFEPSS 0.6%CVE-2026-80229HIGHOpenSSL provider use-after-freeEPSS 0.6%CVE-2026-94266HIGHpassword leak in CURLINFO_EFFECTIVE_URLEPSS 0.6%CVE-2025-15079MEDIUMlibssh global known_hosts overrideEPSS 0.5%CVE-2025-10148MEDIUMpredictable WebSocket maskEPSS 0.5%CVE-2026-6429MEDIUMnetrc credential leak with reused proxy connectionEPSS 0.5%CVE-2026-87866CRITICALwolfSSL public-key pinning bypassEPSS 0.5%CVE-2026-8927CRITICALenv-set cross-proxy Digest auth state leakEPSS 0.5%CVE-2026-13608HIGHOpenLDAP SASL authentication bypassEPSS 0.5%CVE-2026-3783MEDIUMtoken leak with redirect and netrcEPSS 0.5%CVE-2026-9080HIGHUAF after pause in socket callbackEPSS 0.5%CVE-2025-15224LOWlibssh key passphrase bypass without agent setEPSS 0.5%CVE-2026-80255HIGHsecure cookie attribute bypass with tabEPSS 0.5%CVE-2026-7168MEDIUMcross-proxy Digest auth state leakEPSS 0.5%CVE-2026-3784MEDIUMwrong proxy connection reuse with credentialsEPSS 0.4%CVE-2026-8926CRITICALpassword leak with netrc and user in URLEPSS 0.4%CVE-2026-86411CRITICALFTP connection reuse inherits client-certificateEPSS 0.4%CVE-2025-10966MEDIUMmissing SFTP host verification with wolfSSHEPSS 0.4%CVE-2026-86415HIGHauto client cert connection reuse mixupEPSS 0.4%CVE-2025-11563MEDIUMwcurl path traversal with percent-encoded slashesEPSS 0.4%