Lucene search
+L

10607 matches found

OSV
OSV
added 2026/05/04 7:0 a.m.13 views

CLSA-2026-1777878036 curl: Fix of 2 CVEs

CVE-2019-5436: tftp: use the current blksize for recvfrom - CVE-2016-8615: cookie: replace use of fgets with custom version...

7.8CVSS6.8AI score0.49739EPSS
SaveExploits1References1
OSV
OSV
added 2026/05/04 12:0 a.m.6 views

OPENSUSE-SU-2026:10674-1 curl-8.20.0-1.1 on GA media

These are all security issues fixed in the curl-8.20.0-1.1 package on the GA media of openSUSE Tumbleweed...

7.5CVSS5.8AI score0.00719EPSS
SaveExploits6References6
Hacker One
Hacker One
added 2026/05/02 4:25 a.m.21 views

curl: wcurl treats some URL operands after -- as curl options

I found that wcurl does not always keep operands after -- in a pure URL-data context. The documented way to pass curl options through wcurl is --curl-options, but a value supplied as a URL operand can still reach the final curl command as an option, for example wcurl -- "--url=file:///...". A...

6.3AI score
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/05/02 12:23 a.m.12 views

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: curl: curl-8.20.0-0.1.hum1 aarch64, x8664 libcurl-8.20.0-0.1.hum1 aarch64, x8664 libcurl-devel-8.20.0-0.1.hum1 aarch64, x8664 libcurl-minimal-8.20.0-0.1.hum1 aarch64, x8664 curl-8.20.0-0.1.hum1.s...

7.5CVSS5.8AI score0.00719EPSS
SaveExploits6References8
RedHat Linux
RedHat Linux
added 2026/05/02 12:23 a.m.6 views

curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies

A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management CWE-522 may...

5.9CVSS6.9AI score0.00719EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/05/02 12:23 a.m.9 views

curl: curl: Information disclosure due to incorrect TLS connection reuse

A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection via IMAP, SMTP, or POP3 and then making a subsequent request to the same host that requires Transport Layer Security TLS. Due to incorrect connection reuse, the subsequent request would bypass t...

5.9CVSS6.9AI score0.00329EPSS
SaveExploits1References5
Hacker One
Hacker One
added 2026/05/01 5:32 p.m.35 views

curl: libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Proxy Digest auth to a different proxy

Summary: I found an incomplete-fix variant of CVE-2026-7168 in curl 8.20.0. The 8.20.0 fix clears state.proxydigest / state.authproxy when CURLOPTPROXY changes, but not when only CURLOPTPROXYPORT changes. On the same easy handle, request 1 through proxyA CURLOPTPROXYPORT=18197 learns Proxy Digest...

5.3CVSS5.8AI score0.00471EPSS
SaveExploits1
Tenable Nessus
Tenable Nessus
added 2026/05/01 12:0 a.m.8 views

Curl 7.14.1 < 8.20.0 Proxy Credential Disclosure

The version of curl installed on the remote host is 7.14.1 prior to 8.20.0. It is, therefore, affected by a proxy credential disclosure vulnerability: - curl might erroneously pass on credentials for a first proxy to a second proxy. This flaw occurs when different proxies are configured for...

5.9CVSS5.8AI score0.00719EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/05/01 12:0 a.m.7 views

Curl 7.10.6 < 8.20.0 Wrong Reuse of HTTP Negotiate Connection

The version of curl installed on the remote host is 7.10.6 prior to 8.20.0. It is, therefore, affected by an authentication bypass vulnerability: - libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one,...

6.5CVSS5.8AI score0.00414EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/05/01 12:0 a.m.11 views

Curl 8.17.0 < 8.20.0 OCSP Stapling Bypass

The version of curl installed on the remote host is 8.17.0 prior to 8.20.0. It is, therefore, affected by an OCSP stapling bypass vulnerability: - When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is...

5.3CVSS5.8AI score0.00267EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 2026/05/01 12:0 a.m.13 views

Curl 7.40.0 < 8.20.0 Wrong SMB Connection Reuse

The version of curl installed on the remote host is 7.40.0 prior to 8.20.0. It is, therefore, affected by a wrong SMB connection reuse vulnerability: - libcurl might in some circumstances reuse the wrong connection for SMBS transfers. The code erroneously did not consider the share name as a...

7.5CVSS5.8AI score0.00618EPSS
SaveExploits1References2
RedhatCVE
RedhatCVE
added 2026/04/30 1:37 p.m.11 views

CVE-2026-6253

A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management CWE-522 may...

5.9CVSS5.4AI score0.00719EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2026/04/30 1:37 p.m.12 views

CVE-2026-4873

A flaw was found in curl. A remote attacker could exploit this by initiating an unencrypted connection via IMAP, SMTP, or POP3 and then making a subsequent request to the same host that requires Transport Layer Security TLS. Due to incorrect connection reuse, the subsequent request would bypass t...

5.9CVSS5.5AI score0.00329EPSS
SaveExploits1References4
Photon
Photon
added 2026/04/30 12:0 a.m.27 views

Important Photon OS Security Update - PHSA-2026-5.0-0838

Updates of 'curl' packages of Photon OS have been released...

7.5CVSS5.8AI score0.00295EPSS
SaveExploits1
OSV
OSV
added 2026/04/29 2:30 p.m.11 views

CLSA-2026-1777463593 curl: Fix of CVE-2023-27533

CVE-2023-27533: telnet: only accept option arguments in ascii...

9.8CVSS7.3AI score0.01993EPSS
SaveExploits1References1
OSV
OSV
added 2026/04/29 2:28 p.m.9 views

CLSA-2026-1777463367 curl: Fix of CVE-2023-27533

CVE-2023-27533: telnet: only accept option arguments in ascii...

9.8CVSS6.8AI score0.01993EPSS
SaveExploits1References1
UbuntuCve
UbuntuCve
added 2026/04/29 2:0 p.m.11 views

CVE-2026-6253

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. whil...

5.9CVSS5.8AI score0.00719EPSS
SaveExploits1References3
OSV
OSV
added 2026/04/29 2:0 p.m.12 views

UBUNTU-CVE-2026-6253

curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. whil...

5.9CVSS5.8AI score0.00719EPSS
SaveExploits1References4
UbuntuCve
UbuntuCve
added 2026/04/29 2:0 p.m.10 views

CVE-2026-5773

libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the...

7.5CVSS5.8AI score0.00618EPSS
SaveExploits1References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/04/29 8:0 a.m.12 views

Malicious code in apple-coredata-internal-service (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

5.9AI score
SaveExploits0References2
Rows per page
Query Builder