100+ most recent CVEs

curl/libcurl: domain-scoped PSL domain cookie

curl/libcurl: wolfSSL CA-cache hit overrides callback

curl/libcurl: OpenSSL provider use-after-free

curl/libcurl: OpenLDAP SASL authentication bypass

curl/libcurl: WS Auto-PONG memory exhaustion

curl/libcurl: Native CA trust persist

curl/libcurl: QUIC zero-length UDP datagrams busy-loop

curl/libcurl: sending old referer

curl/libcurl: exposing HTTP/3 early data

curl/libcurl: UAF after pause in socket callback

curl/libcurl: stale proxy password leak

curl/libcurl: incomplete mTLS config matching in conn reuse

curl/libcurl: env-set cross-proxy Digest auth state leak

curl/libcurl: password leak with netrc and user in URL

curl/libcurl: wrong reuse for different services

curl/libcurl: cross-proxy Digest auth state leak

curl/libcurl: libssh key passphrase bypass without agent set

curl/libcurl: SOCKS5 heap buffer overflow

curl/libcurl: SMTP send heap buffer overflow

curl/libcurl: FTP shutdown response buffer overflow

curl/libcurl: FTP path trickery leads to NIL byte out of bounds write

curl/libcurl: SSL out of buffer access

curl/libcurl: FILE buffer read out of bounds

curl/libcurl: URL file scheme drive letter buffer overflow

curl/libcurl: SSL_VERIFYSTATUS ignored

curl/libcurl: URL unescape heap overflow via integer truncation

curl/libcurl: invalid URL parsing with '#'

curl/libcurl: IDNA 2003 makes curl use wrong host

curl/libcurl: remote filename path traversal in curl tool for Windows

curl/libcurl: SMB send off unrelated memory contents

curl/libcurl: lingering HTTP credentials in connection reuse

curl/libcurl: hostname out of boundary memory access

curl/libcurl: cookie parser out of boundary memory access

curl/libcurl: Reusing authenticated connection when unauthenticated

curl/libcurl: URL request injection

curl/libcurl: cookie leak with IP address as domain

curl/libcurl: not verifying certs for TLS to IP address / Schannel

curl/libcurl: not verifying certs for TLS to IP address / Secure Transport

curl/libcurl: IP address wildcard certificate validation

curl/libcurl: reuse of wrong HTTP NTLM connection

curl/libcurl: cert name check ignore with GnuTLS

curl/libcurl: cookie domain tailmatch

curl/libcurl: SASL buffer overflow

curl/libcurl: URL sanitization vulnerability

curl/libcurl: inappropriate GSSAPI delegation

curl/libcurl: local file overwrite

curl/libcurl: data callback excessive length

curl/libcurl: embedded zero in cert name

curl/libcurl: URL Buffer Overflow

curl/libcurl: Authentication Buffer Overflows

curl/libcurl: TFTP Packet Buffer Overflow

curl/libcurl: wrong reuse of connections

curl/libcurl: cookie leak for TLDs

curl/libcurl: duphandle read out of bounds

curl/libcurl: sensitive HTTP server headers also sent to proxies

curl/libcurl: use after free in handle close

curl/libcurl: NTLM type-2 out-of-bounds buffer read

curl/libcurl: native CA store conn reuse

curl/libcurl: SASL double-free

curl/libcurl: warning message out-of-buffer read

curl/libcurl: cookie injection for other servers

curl/libcurl: Negotiate not treated as connection-oriented

curl/libcurl: cert name check ignore OpenSSL

curl/libcurl: GnuTLS insufficient cert verification

curl/libcurl: netrc credential leak with reused proxy connection

curl/libcurl: proto-default skips SSH verification

curl/libcurl: Negotiate ambient user conn reuse

curl/libcurl: NTLMv2 type-3 header stack buffer overflow

curl/libcurl: printf floating point buffer overflow

curl/libcurl: Use after free via shared cookies

curl/libcurl: Secure Transport certificate check bypass

curl/libcurl: URL decode buffer boundary flaw

curl/libcurl: Arbitrary File Access

curl/libcurl: NTLM Buffer Overflow

curl/libcurl: cross-origin Digest auth state leak

curl/libcurl: HTTP/2 server push UAF

curl/libcurl: HSTS long filename clears contents

curl/libcurl: OCSP verification bypass with TLS session reuse

curl/libcurl: OpenSSL pinning bypass

curl/libcurl: trailing dot domain super cookie

curl/libcurl: wrong STARTTLS connection reuse

curl/libcurl: SSH improper host validation

curl/libcurl: secure cookie attribute bypass with tab

curl/libcurl: Windows DLL hijacking

curl/libcurl: HTTP/2 stream-dependency tree UAF

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workaround

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and igno

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compr

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<association>? in the UI and GET /resources/:resource/:id/:related/new path, but the actual

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.