10718 matches found
curl: CVE-2026-6429: netrc credential leak with reused proxy connection
Summary: libcurl can leak .netrc-derived host Authorization credentials across redirected hosts when an HTTP proxy connection is reused. In the PoC, .netrc contains credentials only for a.test, but after a.test redirects to b.test and then c.test over the same keep-alive proxy connection, libcurl...
Security Bulletin: Vulnerability in curl affects IBM Netezza Appliance
Summary The curl package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2025-9086 Vulnerability Details CVEID:CVE-2025-9086 DESCRIPTION: 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to...
Security Bulletin: Vulnerability in curl affects IBM Netezza Appliance
Summary The curl package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2023-27534 Vulnerability Details CVEID:CVE-2023-27534 DESCRIPTION: A path traversal vulnerability exists in curl 8.0.0 SFTP implementation causes the tilde character to be wrongl...
Security Bulletin: Vulnerability in curl affects IBM Netezza Appliance
Summary The curl package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2025-9086 Vulnerability Details CVEID:CVE-2025-9086 DESCRIPTION: 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to...
CVE-2026-3784 affecting package curl for versions less than 8.11.1-6
CVE-2026-3784 affecting package curl for versions less than 8.11.1-6. A patched version of the package is available...
CVE-2026-3783 affecting package curl for versions less than 8.11.1-6
CVE-2026-3783 affecting package curl for versions less than 8.11.1-6. A patched version of the package is available...
CVE-2026-1965 affecting package curl for versions less than 8.11.1-6
CVE-2026-1965 affecting package curl for versions less than 8.11.1-6. A patched version of the package is available...
Security Bulletin: Vulnerability impacts AIX due to cURL libcurl (CVE-2025-14524)
Summary Vulnerability in cURL libcurl might wrongly pass on an OAuth2 bearer token CVE-2025-14524. AIX uses cURL libcurl as part of rsyslog, LV/PV encryption integration with HPCS and in Live Update for interacting with HMC. Vulnerability Details CVEID:CVE-2025-14524 DESCRIPTION: When an OAuth2...
Vulnerability impacts AIX due to cURL libcurl (CVE-2025-14524)
IBM SECURITY ADVISORY First Issued: Wed Apr 15 15:24:39 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory9.asc Security Bulletin: Vulnerability impacts AIX due to cURL libcurl CVE-2025-14524...
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
Summary The incomplete fix for AVideo's test.php adds escapeshellarg for wget but leaves the filegetcontents and curl code paths unsanitized, and the URL validation regex /^http/ accepts strings like httpevil.com. Affected Package - Ecosystem: Other - Package: AVideo - Affected versions: = commit...
curl: CVE-2026-6276: stale custom cookie host causes cookie leak
Summary: libcurl keeps a stale data-state.aptr.cookiehost after a request that uses a custom Host: header. On later requests on the same easy handle, when no custom Host: is used, libcurl still reuses that stale value for outgoing cookie selection lib/http.c:2560-2563 and incoming Set-Cookie...
The vulnerability of the libcurl library in software tools for interacting with servers via cURL allows a hacker to induce a service failure.
The vulnerability of the libcurl library in software applications for interacting with servers via cURL is related to improper verification of certificate authenticity. Exploiting this vulnerability can allow an attacker to cause service failures...
curl: CVE-2026-6253: proxy credentials leak over redirect-to proxy
Summary: When libcurl follows a redirect and the new URL causes proxy re-selection, proxy credentials learned from the originally selected proxy URL can remain in per-transfer state and be reused for the next proxy. In the validated case, a redirect from http:// to https:// switches selection fro...
curl: Argument Injection via curl Short-Flag Grouping
This report details how the curl -os command facilitates an Argument Injection vulnerability in applications that wrap the curl command-line tool. The specific command curl -os /etc/passwd --url http://example.com demonstrates a subtle but dangerous behavior. Because -s silent follows -o output,...
Exploit for Use After Free in Haxx Curl
CVE-2026-3805: Use-After-Free in curl SMB Connection Reuse I...
curl: Integer Overflow/Signedness Mismatch in Printf Precision for HTTP/2 Trailer Headers
BUG IN https://raw.githubusercontent.com/curl/curl/07a9b89fedaec60bdbc254f23f66149b31d2f8da/lib/http2.c c ifstream-bodystarted / This is a trailer / H2BUGFinfofdatas, "h2 trailer: %.s: %.s", namelen, name, valuelen, value; result = Curldynaddf&stream-trailerrecvbuf, "%.s: %.s\r\n", namelen, name,...
ClickFix finds a new way to infect Macs
ClickFix campaigns are looking for alternatives now that many Mac users have been made aware of the dangers of pasting certain commands into Terminal. Researchers found that ClickFix has kept the same social engineering playbook but completely sidestepped Terminal by using the applescript:// URL...
Malicious code in @genoma-ui/components (npm)
Malicious package detected. It uses pre/post install scripts to download/execute code and exfiltrate user data via curl from a hardcoded IP. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5fb9acd5bf2a73c82be9ac19b7c0cad285cfea2a4b6ff69655f61e7e4a0c26c The...
