curl: libcurl Digest/NTLM authentication ignores an explicit Authorization header

Summary When an application sets an explicit Authorization header via CURLOPTHTTPHEADER while libcurl also has credentials configured and HTTP Digest or NTLM authentication is selected/challenged, libcurl does not honor the application's header as a replacement — it sends its own internally...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

curl: libcurl cache updates follow symlinks and truncate their targets

Summary: When curl updates an HSTS, Alt-Svc, or cookie cache, it opens the supplied path with "w" before validating it, so a symlink path can truncate the file it targets. Root cause: Curlfopen calls curlxfopenfilename, "w" before checking the path or creating the safe temporary file, and fopen...

curl: Windows SSPI connection-pool probe can reuse a connection under the wrong user

Summary : A fresh transfer can reuse a keep-alive connection authenticated under another Windows user because the SSPI isolation check trusts a connection ID that a health probe can set. Root cause : Curlcpoolconnseemshealthy calls Curlattachconnection, which sets data-state.recentconnid, while...

WordPress: Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the finalizeitem function, which allowed an attacker to...

WordPress: Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the...

Myndr: Myndr CORS Misconfiguration

The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts...

Myndr: CORS Misconfiguration / Broken Access Control

A CORS misconfiguration was discovered on the admin panel that allowed any website hosted on a subdomain of the target organization to read authenticated admin responses, including CSRF nonces and session data. This vulnerability could have enabled full admin account takeover through a CSRF attac...

curl: CVE-2026-19931: Negotiate ambient user conn reuse

Summary On Windows with SSPI/Negotiate, curl 8.21.0 can reuse a connection authenticated with ambient credentials for a later request using different explicit credentials. In urlmatchauthnego, the credential comparison is skipped when conn-creds == NULL. This allows a connection authenticated as...

curl: URL API: triple-slash parses path segment as hostname

Summary libcurl's URL API misparses http:///host/path. Per RFC 3986, the authority between // and / is empty, so /host/path is the path. But parseurl in lib/urlapi.c treats the first segment as the hostname. On line 1087, the slash counter i reaches 3, which is within the valid 1-3 range, and hos...

curl: Cookie jar load skips public suffix check on PSL builds

On curl 8.21.0 with libpsl official curl.se 8.21.06 win64, Features: PSL, HTTP Set-Cookie: Domain=co.uk is dropped in verbose. The same cookie loaded from a Netscape jar file or a Set-Cookie: line in that file is accepted and later sent to unrelated hosts under the suffix bank.co.uk, other.co.uk...

curl: curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking

Summary curl's Curlwsaccept function in lib/ws.c processes the 101 Switching Protocols response to a client WebSocket upgrade request. RFC 6455 Section 4.1 mandates that the client MUST verify the Sec-WebSocket-Accept response header by computing the SHA-1 hash of the concatenation of the...

curl: CVE-2026-18924: HTTP/2 server push UAF

A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed...

curl: Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080

lib/multiev.c keeps a hash table multi-ev.shentries of per-socket bookkeeping structs struct mevshentry used to decide when to notify the application's socket callback CURLMOPTSOCKETFUNCTION about interest changes on a socket. CVE-2026-9080 "multi: handle pause in multi socket callback", commit...

curl: SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication

Summary During testing of curl 8.18.0, I observed that CRLF characters embedded in the SMTP recipient operand used with a custom SMTP request are transmitted as additional SMTP commands. The injected commands are accepted and processed after successful SMTP authentication, allowing multiple SMTP...

IBM: Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated...

MariaDB: MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion

A heap buffer overflow vulnerability was discovered in the hatina::chainappend function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a...

Weblate: Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate

A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the pyparsing library. The grammar was ambiguous at every position and did not enable memoization,...

MariaDB: Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking

A vulnerability was discovered in MariaDB where the keypart-fieldnr value parsed from a crafted .frm file was not validated before being used as an index into the share-field array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C++ virtual method call and achieve...

MariaDB: KILL authorization trusts the presented login name instead of the authenticated anonymous account

A vulnerability was discovered in the KILL authorization process of a database management system. The vulnerability allowed an anonymous account to terminate connections using a supplied login name, even if the authenticated identity was different. This was because the KILL authorization relied o...