CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 11:40 PM ET)

What this means for you

This week: 3,085 CVEs published, 233 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,085; Show in the list
Critical, last 7 days: 233; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product curl:curl. Show all products

89 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2019-5435	Low 3.7	An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. Assigned by hackerone	May 28, 2019
CVE-2019-5436	High 7.8	A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. Assigned by hackerone	May 28, 2019
CVE-2023-38546	Not yet scored	This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. Assigned by hackerone	Oct 17, 2023
CVE-2023-38545	High 8.8	This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. Assigned by hackerone	Oct 17, 2023
CVE-2023-46218	Medium 6.5	This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. Assigned by hackerone	Dec 6, 2023
CVE-2023-46219	Medium 5.3	When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. Assigned by hackerone	Dec 11, 2023
CVE-2024-2004	Low 3.5	Usage of disabled protocol Assigned by curl	Mar 27, 2024
CVE-2024-2398	High 8.6	HTTP/2 push headers memory-leak Assigned by curl	Mar 27, 2024
CVE-2024-2379	Medium 6.3	QUIC certificate check bypass with wolfSSL Assigned by curl	Mar 27, 2024
CVE-2024-2466	Medium 6.5	TLS certificate check bypass with mbedTLS Assigned by curl	Mar 27, 2024

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.