c
curl
Security Risk Profile
55
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 136 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 21, 2005 to present
136
Total CVEs
43
Critical+High
1
Exploited
17
Unpatched
Threat Assessment
Avg CVSS
6.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
17
Critical/High
Risk Level
55/100
medium
⚠️ 1 Active Exploits🆕 3Fresh (<7d)📈 15 in Last 30 Days
Severity Distribution
Critical
11High
32Medium
31Low
4Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
5Age Distribution
Common Weaknesses (CWE)
1
Buffer Overflow
6
2
Infoleak
5
3
Use After Free
4
4
Race Condition
4
5
SSRF
2
Most Affected Products
1. curl libcurl187
2. curl curl155
3. debian/curl42
4. ubuntu/curl38
5. alpine/curl22
Recent Vulnerabilities
See more →CVE-2026-94265
CVSS 9.1critical
Authorization: Negotiate sent to foreign origin
Oct 20, 2026
CVE-2026-87866
CVSS 9.1critical
wolfSSL public-key pinning bypass
Oct 20, 2026
CVE-2026-86415
CVSS 7.5high
auto client cert connection reuse mixup
Oct 20, 2026
CVE-2026-86413
CVSS 9.1critical
Negotiate credentials sent to redirected origin
Oct 20, 2026
CVE-2026-86411
CVSS 9.1critical
FTP connection reuse inherits client-certificate
Oct 20, 2026
https://seclists.org/oss-sec/2026/q4/154
unknown
[SECURITY ADVISORIES] curl 8.23.0
Oct 14, 2026🔧 No Patch
CVE-2026-86412
CVSS 8.1high
server-set cookie erases cookie jar
Oct 14, 2026
CVE-2026-86410
CVSS 8.1high
redirect to SFTP or SCP bypasses host verification
Oct 14, 2026
CVE-2026-87863
CVSS 8.1high
HSTS response erases persisted entries
Oct 14, 2026
CVE-2026-92390
CVSS 7.5high
-J no-clobber guarantee bypassed with 103 early hints
Oct 14, 2026
Monitor curl in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.