2026

When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving t

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not pos

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmi

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later f

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequen

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previous

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already

An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) t

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality o

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality o

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functio

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functio

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functio

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functio

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X200

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X200

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s

A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s):

An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X

A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (vers

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X20

A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTO

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() func

Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference d

The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferenci

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-

A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLIN

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-

The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list ad

When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due

PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requ

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then cop

The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold th

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthe

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers t

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers t

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated at

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthen