CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,443
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product curl:curl. Show all products

26 CVEs, showing 1 to 26
CVESeverityTitlePublished
CVE-2026-92392High 8.1HTTP/2 upload Use-After-Free
Assigned by curl
Oct 14, 2026
CVE-2026-82209High 8.2domain-scoped PSL domain cookie
Assigned by curl
Sep 6, 2026
CVE-2026-82208High 7.5wolfSSL CA-cache hit overrides callback
Assigned by curl
Sep 6, 2026
CVE-2026-80255High 7.5secure cookie attribute bypass with tab
Assigned by curl
Sep 6, 2026
CVE-2026-80231High 7.5native CA store conn reuse
Assigned by curl
Sep 6, 2026
CVE-2026-80230High 7.5OpenSSL pinning bypass
Assigned by curl
Sep 6, 2026
CVE-2026-80229High 7.5OpenSSL provider use-after-free
Assigned by curl
Sep 6, 2026
CVE-2026-19931Critical 9.8Negotiate ambient user conn reuse
Assigned by curl
Sep 6, 2026
CVE-2026-18924Critical 9.1HTTP/2 server push UAF
Assigned by curl
Sep 6, 2026
CVE-2026-13608High 7.4OpenLDAP SASL authentication bypass
Assigned by curl
Sep 6, 2026
CVE-2025-0725High 7.3gzip integer overflow
Assigned by curl
Feb 5, 2025
CVE-2025-0665High 7.0eventfd double close
Assigned by curl
Feb 5, 2025
CVE-2025-0167Low 3.4netrc and default credential leak
Assigned by curl
Feb 5, 2025
CVE-2024-11053Low 3.4netrc and redirect credential leak
Assigned by curl
Dec 11, 2024
CVE-2024-8096Medium 6.5OCSP stapling bypass with GnuTLS
Assigned by curl
Sep 11, 2024
CVE-2024-7264Medium 6.3ASN.1 date parser overread
Assigned by curl
Jul 31, 2024
CVE-2024-2466Medium 6.5TLS certificate check bypass with mbedTLS
Assigned by curl
Mar 27, 2024
CVE-2024-2379Medium 6.3QUIC certificate check bypass with wolfSSL
Assigned by curl
Mar 27, 2024
CVE-2024-2398High 8.6HTTP/2 push headers memory-leak
Assigned by curl
Mar 27, 2024
CVE-2024-2004Low 3.5Usage of disabled protocol
Assigned by curl
Mar 27, 2024
CVE-2023-46219Medium 5.3When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
Assigned by hackerone
Dec 12, 2023
CVE-2023-46218Medium 6.5This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.
Assigned by hackerone
Dec 7, 2023
CVE-2023-38545High 8.8This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.
Assigned by hackerone
Oct 18, 2023
CVE-2023-38546Not yet scoredThis flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.
Assigned by hackerone
Oct 18, 2023
CVE-2019-5436High 7.8A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
Assigned by hackerone
May 28, 2019
CVE-2019-5435Low 3.7An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
Assigned by hackerone
May 28, 2019

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.