CVE Tools
Track your stack

Curl

188 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Curl, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Curl CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Curl CVEs per month
MonthCVEs
2024-121
2025-010
2025-023
2025-030
2025-040
2025-052
2025-061
2025-070
2025-080
2025-092
2025-100
2025-111
2025-120
2026-016
2026-021
2026-034
2026-040
2026-058
2026-060
2026-0718
2026-080
2026-099
2026-1024
2026-110

Severity

How the 188 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical3116%
  • High7339%
  • Medium6736%
  • Low179%

Latest CVEs

The 15 most recently published vulnerabilities affecting Curl.

  1. CVE-2026-107929local interface connection reuse mixup8.1
  2. CVE-2026-107928info leak uploading over WebSockets with GnuTLS8.1
  3. CVE-2026-94266password leak in CURLINFO_EFFECTIVE_URL7.5
  4. CVE-2026-94265Authorization: Negotiate sent to foreign origin9.1
  5. CVE-2026-92391curl_mime_free stack overflow by recursion7.5
  6. CVE-2026-92390-J no-clobber guarantee bypassed with 103 early hints7.5
  7. CVE-2026-92389TFTP direction confusion8.1
  8. CVE-2026-92388FTP wildcard write callback mixup9.1
  9. CVE-2026-92387never-ending loop via server response omission8.1
  10. CVE-2026-92386server-set cookie aborts cookie jar load8.1
  11. CVE-2026-87866wolfSSL public-key pinning bypass9.1
  12. CVE-2026-87865knownhost callback mismatches key as missing7.4
  13. CVE-2026-87863HSTS response erases persisted entries8.1
  14. CVE-2026-87864IMAP APPEND plus CRLF conversion command injection8.1
  15. CVE-2026-87862HSTS cache import drops longer-lived child8.1

Product grouping is registry-driven, with AI assist and human review. How it works