46
CVEs
10
Critical
19
High
0
KEV
7
PoC
2
Unpatched C/H
95.7%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
19
MEDIUM
16
LOW
1
Monthly CVE Trend
Affected Products (30)
Curl
139
Debian Linux
61
Libcurl
53
Universal Forwarder
48
Splunk
48
H410s Firmware
41
H700s Firmware
41
H300s Firmware
41
H500s Firmware
40
Fedora
40
Clustered Data Ontap
39
Ubuntu Linux
27
Sinec Infrastructure Network Services
18
macOS
18
Mysql Server
17
Hci Management Node
15
Solidfire
15
Active Iq Unified Manager
14
Solidfire Hci Management Node
14
Peoplesoft Enterprise Peopletools
12
Mac Os X
12
Cloud Backup
11
Enterprise Manager Ops Center
11
Opensuse
11
Hci Bootstrap Os
10
H700E Firmware
9
Oncommand Workflow Automation
9
H300E Firmware
9
Oncommand Insight
9
H500E Firmware
9
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-3805 | Curl's SMB implementation contains a use-after-free vulnerability that causes denial of service when processing consecutive requests to the same host, as the library incorrectly dereferences freed memory on subsequent connections. Public exploit code exists for this vulnerability affecting Curl installations. An attacker can crash Curl-based applications or services by triggering multiple SMB requests, though remote code execution is not possible due to the nature of the memory corruption. | HIGH | 7.5 | 0.0% | 58 |
PoC
|
| CVE-2026-3784 | curl's HTTP proxy connection reuse mechanism fails to validate credential changes, allowing an attacker to intercept or manipulate traffic by leveraging an existing proxy connection established with different authentication. This affects users whose applications reuse proxy connections across requests with varying credentials, enabling credential confusion attacks. Public exploit code exists for this vulnerability, though a patch is available. | MEDIUM | 6.5 | 0.0% | 53 |
PoC
|
| CVE-2026-19931 | Cross-user session confusion in libcurl allows one user's HTTP request to be silently transmitted over another user's previously authenticated Negotiate (SPNEGO/Kerberos) connection. When an initial request to a host is made with empty credentials, libcurl incorrectly treats the resulting connection as eligible for reuse, so a subsequent request from a different principal inherits the earlier authenticated context. There is no public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile), and the flaw is only meaningful in multi-user or proxy-style deployments that share a single libcurl handle/connection pool. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-9079 | Proxy-credential leakage in libcurl (curl 8.8.0 through 8.20.0) occurs because a request to clear previously set proxy authentication credentials is silently ignored, so the stale username/password remain attached to the reused easy handle and are sent on later transfers that were never meant to use them. This is an information-disclosure defect (tagged Information Disclosure, EUVD-2026-41510) affecting applications that reuse libcurl handles across multiple proxied requests. No public exploit identified at time of analysis and EPSS is low (0.25%, 16th percentile), consistent with a coding/logic flaw rather than a directly weaponizable remote bug. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-11856 | Cross-origin credential leakage in libcurl (curl 7.10.6 through 8.20.0) causes the HTTP Digest 'Authorization:' header computed for one origin (hostA) to be wrongly reused on a subsequent transfer to a different origin (hostB) when an application reuses the same easy handle. This exposes Digest authentication credentials to an unintended, potentially attacker-controlled host, and is tracked as an Information Disclosure issue (EUVD-2026-41501). No public exploit identified at time of analysis; EPSS is low at 0.25% (16th percentile) and it is not in CISA KEV, so this is a latent credential-exposure bug rather than a demonstrated mass-exploitation threat. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-8925 | Memory-safety defect (double-free) in curl's SASL authentication path affects versions 8.15.0 through 8.20.0 when built with GSASL support: the GSASL context is cleaned up twice without the intervening pointer being cleared, causing the same allocation to be free()'d twice. A malicious or malfunctioning mail/auth server exercising the SASL handshake could trigger the condition, potentially corrupting heap memory and at minimum crashing the client. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile) despite the headline CVSS of 9.8. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-10536 | Use-after-free in libcurl's HTTP/2 stream-dependency handling affects a wide range of curl releases (7.88.0 through 8.20.0) when an application sets CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset() before curl_easy_cleanup(); the reset frees an internal priority structure that cleanup later re-accesses. Despite the NVD 9.8 CVSS rating, the flaw is only reachable through a specific application-controlled API call sequence rather than remote attacker input, and is tagged Information Disclosure. No public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2025-14524 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. [CVSS 5.3 MEDIUM] | MEDIUM | 5.3 | 0.0% | 47 |
PoC
|
| CVE-2025-15079 | When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. [CVSS 5.3 MEDIUM] | MEDIUM | 5.3 | 0.0% | 47 |
PoC
|
| CVE-2026-3783 | OAuth2 bearer token leakage in curl and .NET occurs when HTTP redirects are followed to a second hostname that matches entries in the .netrc configuration file, allowing attackers to obtain valid authentication tokens for unintended hosts. Public exploit code exists for this vulnerability affecting curl and .NET applications that rely on OAuth2 authentication with automatic redirect handling. This medium-severity vulnerability (CVSS 5.3) requires network access but no user interaction, and patches are available from vendors. | MEDIUM | 5.3 | 0.0% | 47 |
PoC
|
| CVE-2026-8927 | Proxy credential leakage in libcurl (curl) occurs when a single reused easy handle drives sequential transfers through different environment-variable-configured proxies: after Digest-authenticating to proxyA, libcurl fails to reset the proxy authentication state, so the `Proxy-Authorization:` header meant for proxyA is resent to proxyB. Any application relying on handle reuse with env-var proxy settings and multiple upstream proxies can disclose proxyA's credentials to an unauthorized proxy operator. EPSS is low (0.25%, 16th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis - this is a credential-confidentiality issue rather than a code-execution flaw. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-8924 | Cross-domain cookie injection in curl (versions 7.46.0 through 8.20.0) lets a malicious or compromised HTTP server set 'super cookies' that bypass the Public Suffix List (PSL) safeguard, causing curl to scope attacker-supplied cookies to unrelated third-party domains and transmit them on later requests. Rated CVSS 9.1 and tagged as an authentication bypass, the flaw undermines cookie origin isolation, but EPSS is low at 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. A patched release is available from the curl project. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-18924 | Use-after-free in libcurl's HTTP/2 Server Push handling affects applications that enable server push while sharing connections across easy handles via the curl share interface. A malicious or compromised HTTP/2 server can trigger the freed-then-reused memory during connection cleanup, leading to memory corruption, crashes, and potential integrity impact against any of the vast range of software that embeds libcurl. EPSS is low (0.21%, 11th percentile) and there is a referenced HackerOne report (#3916059) but no public exploit code and no CISA KEV listing; no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-11564 | TLS certificate-trust confusion in libcurl (curl 8.17.0 through 8.20.0) lets a reused pooled connection retain trust in the native platform CA store even after the application reconfigures the same easy handle to use custom CA material for a later transfer. An attacker positioned to intercept traffic could present a certificate valid under the native store - which the application intended to no longer trust - to silently intercept or spoof the connection. Rated CVSS 9.1, but EPSS is only 0.20% (9th percentile) and there is no public exploit identified at time of analysis, reflecting the narrow application-usage prerequisite rather than a broadly weaponizable flaw. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-8926 | Credential disclosure in curl 8.11.1 through 8.20.0 (and earlier) lets curl silently substitute the wrong password when .netrc lookup is combined with a URL that carries a username but no password, such as https://user@example.com/. When no matching entry exists for the specified user, curl falls back to a different user's password stored for that same host and transmits it during authentication, potentially leaking one user's secret to a server or to an unintended account. Publicly available exploit-flow details exist via the originating HackerOne report; EPSS is low (0.20%, 9th percentile) and it is not in CISA KEV. | CRITICAL | 9.1 | 0.2% | 46 |
|