Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Moderate: curl security updateOpen the advisoryOct 15, 2026
- Unknowncurl vulnerabilitiesOpen the advisoryOct 14, 2026
- Unknowncurl vulnerabilitiesOpen the advisoryOct 14, 2026
- Medium6.9Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CU…Check if you run itEPSS 0.48%May 28, 2026
- Medium5.3Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a second transferCheck if you run itEPSS 0.47%May 13, 2026
- Medium5.3When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstanCheck if you run itEPSS 0.52%May 13, 2026
- High7.5Using libcurl, when a custom header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom header set, the sCheck if you run itEPSS 0.35%May 13, 2026
- High7.5libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.Check if you run itEPSS 0.66%May 13, 2026
- Medium6.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.Check if you run itEPSS 0.41%May 13, 2026
- High8.6curl_cffi is the a Python binding for curl.Check if you run itEPSS 0.45%Apr 6, 2026
- Medium6.5libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.Check if you run itEPSS 0.26%Mar 11, 2026
- Medium5.3When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in t…Check if you run itEPSS 0.55%Jan 8, 2026
- Medium5.3When doing TLS related transfers with reused easy or multi handles and altering the option, libcurl could accidentally reuse a CA store cached in memory for which the partial chainCheck if you run itEPSS 0.76%Jan 8, 2026
- Medium5.9When using option with libcurl or with the curl tool, curl should check the public key of the server certificate to verify the peer.Open the advisoryJan 8, 2026
- Medium6.5libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL.Check this weekEPSS 29.00%May 28, 2025
- High7.3When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the option, **using zlib 1.2.0.3 or older**, an attacker-controlle…Check if you run itEPSS 1.80%Feb 5, 2025
- High7.0libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.Check if you run itEPSS 1.33%Feb 5, 2025
- Medium6.5libcurl's ASN1 parser code has the function, used for parsing an ASN.1 Generalized Time field.Check this weekEPSS 20.20%Jul 31, 2024
- Medium6.5libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS.Check if you run itEPSS 1.45%Mar 27, 2024
- High8.6When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), lib…Check this weekEPSS 36.08%Mar 27, 2024
- Medium6.3libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL.Check if you run itEPSS 1.86%Mar 27, 2024
- Medium5.5An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option wa…Check if you run itEPSS 1.45%Mar 30, 2023
- Medium5.9A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles".Check if you run itEPSS 1.90%Mar 30, 2023
- Medium5.9An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user per…Check if you run itEPSS 1.76%Mar 30, 2023
- Medium5.9An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers.Check if you run itEPSS 1.80%Mar 30, 2023
44 records · page 1 of 2
PreviousNext