9
CVEs
2
Critical
7
High
0
KEV
0
PoC
2
Unpatched C/H
77.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
7
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Curl
139
Debian Linux
61
Libcurl
53
Universal Forwarder
48
Splunk
48
H410s Firmware
41
H700s Firmware
41
H300s Firmware
41
H500s Firmware
40
Fedora
40
Clustered Data Ontap
39
Ubuntu Linux
27
Sinec Infrastructure Network Services
18
macOS
18
Mysql Server
17
Hci Management Node
15
Solidfire
15
Active Iq Unified Manager
14
Solidfire Hci Management Node
14
Peoplesoft Enterprise Peopletools
12
Mac Os X
12
Cloud Backup
11
Enterprise Manager Ops Center
11
Opensuse
11
Hci Bootstrap Os
10
H700E Firmware
9
Oncommand Workflow Automation
9
H300E Firmware
9
Oncommand Insight
9
H500E Firmware
9
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19931 | Cross-user session confusion in libcurl allows one user's HTTP request to be silently transmitted over another user's previously authenticated Negotiate (SPNEGO/Kerberos) connection. When an initial request to a host is made with empty credentials, libcurl incorrectly treats the resulting connection as eligible for reuse, so a subsequent request from a different principal inherits the earlier authenticated context. There is no public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile), and the flaw is only meaningful in multi-user or proxy-style deployments that share a single libcurl handle/connection pool. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-18924 | Use-after-free in libcurl's HTTP/2 Server Push handling affects applications that enable server push while sharing connections across easy handles via the curl share interface. A malicious or compromised HTTP/2 server can trigger the freed-then-reused memory during connection cleanup, leading to memory corruption, crashes, and potential integrity impact against any of the vast range of software that embeds libcurl. EPSS is low (0.21%, 11th percentile) and there is a referenced HackerOne report (#3916059) but no public exploit code and no CISA KEV listing; no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-82209 | curl and libcurl through version 8.21.0 incorrectly handle domain-scoped cookies for Public Suffix List (PSL) domains, permitting a malicious server to set cookies scoped to a PSL entry rather than rejecting them as standards require. This flaw enables cross-subdomain cookie propagation under shared public suffix registries (e.g., github.io, co.uk), potentially exposing session tokens or enabling session fixation against other services the victim connects to under the same PSL domain. No public exploit code exists and CISA KEV listing is absent; the vulnerability was fixed in curl 8.22.0 released September 2, 2026. | HIGH | 8.2 | 0.2% | 41 |
|
| CVE-2026-80229 | Heap-use-after-free in libcurl versions 8.14.0 through 8.21.0 allows remote unauthenticated attackers to crash applications performing concurrent TLS transfers via the multi interface. When libcurl builds against OpenSSL 3 with provider configurations, an allocated OpenSSL library context is tied to an easy handle's lifetime without an ownership reference being passed to OpenSSL; if the easy handle is destroyed while a pooled TLS connection remains active, subsequent I/O or post-handshake operations dereference the freed context, triggering a heap-use-after-free. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS remains low at 0.22% (12th percentile). | HIGH | 7.5 | 0.2% | 38 |
|
| CVE-2026-80255 | Secure-flag stripping in curl 8.13.0 through 8.21.0 allows a server to cause curl to transmit session cookies over unencrypted HTTP by returning a Set-Cookie header that places a horizontal tab character (ASCII 9) instead of a space immediately before the Secure attribute. curl's cookie parser fails to recognise the attribute under this condition, stores the cookie without its Secure constraint, and subsequently includes it in plaintext HTTP requests to the same host. No public exploit code has been identified and EPSS probability is 0.22% (12th percentile), reflecting low observed exploitation activity despite the straightforward triggering mechanism. | HIGH | 7.5 | 0.2% | 38 |
|
| CVE-2026-80231 | Connection pool mismanagement in libcurl silently reuses HTTPS connections across requests that differ in their `CURLSSLOPT_NATIVE_CA` (Native CA Store) SSL option, affecting all curl releases from 7.71.0 through 8.21.0. When an application uses a shared connection pool to the same hostname with mixed native CA settings, libcurl fails to distinguish connections by their CA trust configuration, potentially applying the wrong certificate authority validation to a subsequent request. No public exploit code exists and EPSS sits at 0.21% (12th percentile), indicating low active exploitation probability, though the vulnerability's broad version footprint - spanning several years of releases - makes it relevant wherever libcurl is deployed with mixed native CA configurations. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-80230 | Public key pinning enforcement in libcurl (versions 7.45.0 through at least 8.21.0) is silently bypassed when CURLOPT_PINNEDPUBLICKEY is combined with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 - the exact configuration adopted by applications that rely on pinning as their sole TLS trust anchor after disabling standard certificate chain validation. When a server presents no certificate at all, libcurl's pin-check code path is never reached and the connection succeeds, enabling a network-positioned attacker to conduct MITM attacks against applications that believed pinning would protect them. No public exploit is identified at time of analysis and EPSS stands at 0.14% (4th percentile), indicating limited opportunistic exploitation activity despite the broad version range affected. | HIGH | 7.5 | 0.1% | 38 |
|
| CVE-2026-82208 | Certificate validation bypass in libcurl (curl 8.9.1 through 8.21.0) with the wolfSSL TLS backend allows a network-positioned attacker to intercept encrypted communications by exploiting a post-callback CA store reinstatement bug. When an application uses CURLOPT_SSL_CTX_FUNCTION to install a custom trust store at connection time, libcurl silently overwrites that callback-selected store with the previously cached CA bundle, causing certificates that the callback explicitly rejected to be accepted without error. EPSS is 0.13% (3rd percentile) and no active exploitation is confirmed, but exploitation against a susceptible deployment is conceptually straightforward for a MITM-positioned adversary with a suitable certificate. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-13608 | libcurl's SASL state machine for LDAP authentication incorrectly treats an incomplete cryptographic handshake as a fully verified authentication exchange, allowing a Man-in-the-Middle attacker to inject a premature termination message that bypasses peer validation entirely. All curl releases from 7.82.0 through 8.21.0 are affected, spanning a multi-year release history documented in EUVD-2026-72164 and the curl project's own advisory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though successful exploitation grants an attacker the ability to intercept LDAP credentials and inject falsified directory responses. | HIGH | 7.4 | 0.3% | 37 |
|