27
CVEs
10
Critical
16
High
0
KEV
0
PoC
2
Unpatched C/H
92.6%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
16
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Curl
139
Debian Linux
61
Libcurl
53
Universal Forwarder
48
Splunk
48
H410s Firmware
41
H700s Firmware
41
H300s Firmware
41
H500s Firmware
40
Fedora
40
Clustered Data Ontap
39
Ubuntu Linux
27
Sinec Infrastructure Network Services
18
macOS
18
Mysql Server
17
Hci Management Node
15
Solidfire
15
Active Iq Unified Manager
14
Solidfire Hci Management Node
14
Peoplesoft Enterprise Peopletools
12
Mac Os X
12
Cloud Backup
11
Enterprise Manager Ops Center
11
Opensuse
11
Hci Bootstrap Os
10
H700E Firmware
9
Oncommand Workflow Automation
9
H300E Firmware
9
Oncommand Insight
9
H500E Firmware
9
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19931 | Cross-user session confusion in libcurl allows one user's HTTP request to be silently transmitted over another user's previously authenticated Negotiate (SPNEGO/Kerberos) connection. When an initial request to a host is made with empty credentials, libcurl incorrectly treats the resulting connection as eligible for reuse, so a subsequent request from a different principal inherits the earlier authenticated context. There is no public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile), and the flaw is only meaningful in multi-user or proxy-style deployments that share a single libcurl handle/connection pool. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-9079 | Proxy-credential leakage in libcurl (curl 8.8.0 through 8.20.0) occurs because a request to clear previously set proxy authentication credentials is silently ignored, so the stale username/password remain attached to the reused easy handle and are sent on later transfers that were never meant to use them. This is an information-disclosure defect (tagged Information Disclosure, EUVD-2026-41510) affecting applications that reuse libcurl handles across multiple proxied requests. No public exploit identified at time of analysis and EPSS is low (0.25%, 16th percentile), consistent with a coding/logic flaw rather than a directly weaponizable remote bug. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-11856 | Cross-origin credential leakage in libcurl (curl 7.10.6 through 8.20.0) causes the HTTP Digest 'Authorization:' header computed for one origin (hostA) to be wrongly reused on a subsequent transfer to a different origin (hostB) when an application reuses the same easy handle. This exposes Digest authentication credentials to an unintended, potentially attacker-controlled host, and is tracked as an Information Disclosure issue (EUVD-2026-41501). No public exploit identified at time of analysis; EPSS is low at 0.25% (16th percentile) and it is not in CISA KEV, so this is a latent credential-exposure bug rather than a demonstrated mass-exploitation threat. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-8925 | Memory-safety defect (double-free) in curl's SASL authentication path affects versions 8.15.0 through 8.20.0 when built with GSASL support: the GSASL context is cleaned up twice without the intervening pointer being cleared, causing the same allocation to be free()'d twice. A malicious or malfunctioning mail/auth server exercising the SASL handshake could trigger the condition, potentially corrupting heap memory and at minimum crashing the client. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile) despite the headline CVSS of 9.8. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-10536 | Use-after-free in libcurl's HTTP/2 stream-dependency handling affects a wide range of curl releases (7.88.0 through 8.20.0) when an application sets CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset() before curl_easy_cleanup(); the reset frees an internal priority structure that cleanup later re-accesses. Despite the NVD 9.8 CVSS rating, the flaw is only reachable through a specific application-controlled API call sequence rather than remote attacker input, and is tagged Information Disclosure. No public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-8927 | Proxy credential leakage in libcurl (curl) occurs when a single reused easy handle drives sequential transfers through different environment-variable-configured proxies: after Digest-authenticating to proxyA, libcurl fails to reset the proxy authentication state, so the `Proxy-Authorization:` header meant for proxyA is resent to proxyB. Any application relying on handle reuse with env-var proxy settings and multiple upstream proxies can disclose proxyA's credentials to an unauthorized proxy operator. EPSS is low (0.25%, 16th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis - this is a credential-confidentiality issue rather than a code-execution flaw. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-8924 | Cross-domain cookie injection in curl (versions 7.46.0 through 8.20.0) lets a malicious or compromised HTTP server set 'super cookies' that bypass the Public Suffix List (PSL) safeguard, causing curl to scope attacker-supplied cookies to unrelated third-party domains and transmit them on later requests. Rated CVSS 9.1 and tagged as an authentication bypass, the flaw undermines cookie origin isolation, but EPSS is low at 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. A patched release is available from the curl project. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-18924 | Use-after-free in libcurl's HTTP/2 Server Push handling affects applications that enable server push while sharing connections across easy handles via the curl share interface. A malicious or compromised HTTP/2 server can trigger the freed-then-reused memory during connection cleanup, leading to memory corruption, crashes, and potential integrity impact against any of the vast range of software that embeds libcurl. EPSS is low (0.21%, 11th percentile) and there is a referenced HackerOne report (#3916059) but no public exploit code and no CISA KEV listing; no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-11564 | TLS certificate-trust confusion in libcurl (curl 8.17.0 through 8.20.0) lets a reused pooled connection retain trust in the native platform CA store even after the application reconfigures the same easy handle to use custom CA material for a later transfer. An attacker positioned to intercept traffic could present a certificate valid under the native store - which the application intended to no longer trust - to silently intercept or spoof the connection. Rated CVSS 9.1, but EPSS is only 0.20% (9th percentile) and there is no public exploit identified at time of analysis, reflecting the narrow application-usage prerequisite rather than a broadly weaponizable flaw. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-8926 | Credential disclosure in curl 8.11.1 through 8.20.0 (and earlier) lets curl silently substitute the wrong password when .netrc lookup is combined with a URL that carries a username but no password, such as https://user@example.com/. When no matching entry exists for the specified user, curl falls back to a different user's password stored for that same host and transmits it during authentication, potentially leaking one user's secret to a server or to an unintended account. Publicly available exploit-flow details exist via the originating HackerOne report; EPSS is low (0.20%, 9th percentile) and it is not in CISA KEV. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-82209 | curl and libcurl through version 8.21.0 incorrectly handle domain-scoped cookies for Public Suffix List (PSL) domains, permitting a malicious server to set cookies scoped to a PSL entry rather than rejecting them as standards require. This flaw enables cross-subdomain cookie propagation under shared public suffix registries (e.g., github.io, co.uk), potentially exposing session tokens or enabling session fixation against other services the victim connects to under the same PSL domain. No public exploit code exists and CISA KEV listing is absent; the vulnerability was fixed in curl 8.22.0 released September 2, 2026. | HIGH | 8.2 | 0.2% | 41 |
|
| CVE-2026-8286 | Information disclosure and integrity exposure in curl/libcurl occurs when a new transfer that uses STARTTLS to upgrade a connection may reuse an already-established live connection whose TLS configuration does not match the requested one, so data intended for a strictly-configured secure channel can traverse a connection negotiated under different (potentially weaker or unverified) TLS settings. The flaw affects a very wide range of curl releases from 7.30.0 through 8.20.0 and is tagged as Information Disclosure with high confidentiality and integrity impact (CVSS 8.1). It is not listed in CISA KEV, EPSS is low (0.20%, 9th percentile), and no public exploit code is identified at time of analysis. | HIGH | 8.1 | 0.2% | 41 |
|
| CVE-2026-11352 | Remote denial of service in curl and libcurl (versions 8.18.0 through 8.20.0) lets a malicious or compromised HTTP/3 server indefinitely stall a connecting client. The flaw lives in curl's QUIC UDP receive path, where zero-length UDP datagrams are discarded before they are counted against the per-call packet budget, so a peer that streams a continuous flood of empty datagrams keeps the receive loop spinning without ever making progress. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and impact is availability-only (no data compromise). | HIGH | 7.5 | 0.3% | 38 |
|
| CVE-2026-80229 | Heap-use-after-free in libcurl versions 8.14.0 through 8.21.0 allows remote unauthenticated attackers to crash applications performing concurrent TLS transfers via the multi interface. When libcurl builds against OpenSSL 3 with provider configurations, an allocated OpenSSL library context is tied to an easy handle's lifetime without an ownership reference being passed to OpenSSL; if the easy handle is destroyed while a pooled TLS connection remains active, subsequent I/O or post-handshake operations dereference the freed context, triggering a heap-use-after-free. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS remains low at 0.22% (12th percentile). | HIGH | 7.5 | 0.2% | 38 |
|
| CVE-2026-80255 | Secure-flag stripping in curl 8.13.0 through 8.21.0 allows a server to cause curl to transmit session cookies over unencrypted HTTP by returning a Set-Cookie header that places a horizontal tab character (ASCII 9) instead of a space immediately before the Secure attribute. curl's cookie parser fails to recognise the attribute under this condition, stores the cookie without its Secure constraint, and subsequently includes it in plaintext HTTP requests to the same host. No public exploit code has been identified and EPSS probability is 0.22% (12th percentile), reflecting low observed exploitation activity despite the straightforward triggering mechanism. | HIGH | 7.5 | 0.2% | 38 |
|