← 返回地图破甲

浏览报告

仅含 CVE

15,219 份报告 · 本页赏金 $0

Re-entrant curl_easy_pause UAF in cw-pause内存破坏curl低危—2026-11-03 Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields信息泄露WordPress中危—2026-11-05 Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host信息泄露curl低危—2026-10-27 CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry业务逻辑curl低危—2026-10-23 CVE-2026-115529: Schannel TLS auto client session resumption身份认证curl低危—2026-10-26 --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)密码学缺陷curl低危—2026-10-23 Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)内存破坏curl低危—2026-10-23 POP3: data after the end-of-body terminator is written into the retrieved message其他弱点curl低危—2026-10-21 A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident其他弱点curl低危—2026-10-22 server filename with control characters printed to terminal (`-J`)注入与走私curl低危—2026-10-26 IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host服务端请求伪造curl中危—2026-10-21 HSTS cache file: three trailing dots silently disable HSTS for that host密码学缺陷curl低危—2026-10-20 TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another密码学缺陷curl低危—2026-10-20 curl reuses an HTTPS connection when a response is already buffered in the TLS stack其他弱点curl低危—2026-10-20 Pinned public key check passes for a key the server does not hold with the wolfSSL backend密码学缺陷curl低危—2026-10-22 CVE-2026-115528: wolfSSL TLS connect without cert密码学缺陷curl低危—2026-10-26 urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host其他弱点curl低危—2026-10-19 wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)密码学缺陷curl低危—2026-10-20 Derived cookie Path aborts cookie jar loading in curl 8.23.0其他弱点curl低危—2026-10-26 SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections身份认证curl低危—2026-10-19 OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples密码学缺陷curl低危—2026-10-26 Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches其他弱点curl低危—2026-10-20 curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)拒绝服务curl低危—2026-10-23 netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)身份认证curl低危—2026-10-26 CVE-2026-111951: curl -OJ truncate without filename路径遍历curl低危—2026-10-26