CVE-2026-87862: HSTS cache import drops longer-lived child #3972357 Valid Cryptography – 2026-10-14 – – CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection #3972403 Valid Injection and Smuggling – 2026-10-14 – – CVE-2026-86409: stale SigV4 headers sent unintended #3973135 Valid Information Disclosure – 2026-10-14 – – CVE-2026-86410: redirect to SFTP or SCP bypasses host verification #3973176 Valid Cryptography – 2026-10-14 – – CVE-2026-86412: server-set cookie erases cookie jar #3973201 Valid Input Validation and Logic – 2026-10-14 – – CVE-2026-87865: knownhost callback mismatches key as missing #3975408 Valid Cryptography Low 2026-10-14 – – CVE-2026-86414: leaking host credentials to HTTP proxy #3993566 Valid No weakness recorded Low 2026-10-14 – – CVE-2026-92386: server-set cookie aborts cookie jar load #4021979 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92387: never-ending loop via server response omission #4022003 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92388: FTP wildcard write callback mixup #4022070 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92389: TFTP direction confusion #4022568 Valid No weakness recorded None 2026-10-14 – – CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints #4023192 Valid No weakness recorded None 2026-10-14 – – CVE-2026-8924: trailing dot domain super cookie #3733905 Valid Input Validation and Logic Low 2026-06-24 – 1 CVE-2026-87861: cross-origin reuse of a Negotiate connection #3972094 Valid Authentication Low 2026-10-14 – 1 CVE-2026-80255: secure cookie attribute bypass with tab #3972395 Valid Input Validation and Logic – 2026-09-03 – 1 CVE-2026-86411: FTP connection reuse inherits client-certificate #3973190 Valid Authentication – 2026-10-14 – 1 CVE-2026-94265: Authorization: Negotiate sent to foreign origin #4040551 Valid No weakness recorded None 2026-10-14 – 1 CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL #4041053 Valid No weakness recorded None 2026-10-14 – 1 CVE-2026-111480: pause UAF from within callback #4102061 Valid Memory Corruption Low 2026-10-26 – 1 CVE-2026-111482: libssh2 knownhosts prefix match #4112709 Valid Input Validation and Logic Low 2026-10-26 – 1 CVE-2026-111481: server-set cookie still aborts cookie jar #4112912 Valid Input Validation and Logic Low 2026-10-26 – 1 CVE-2026-111950: TLS session cache diff scheme reuse #4122175 Valid Input Validation and Logic Low 2026-10-26 – 1 CVE-2026-111952: OpenSSL provider use-after-free again #4122239 Valid Memory Corruption Medium 2026-10-26 – 1 CVE-2026-111954: upload reader failed redirect UAF #4123190 Valid Memory Corruption Low 2026-10-26 – 1 CVE-2026-115529: Schannel TLS auto client session resumption #4136767 Valid Authentication Low 2026-10-26 – 1 CVE-2022-42916: HSTS bypass via IDN #1730660 Valid Cryptography Medium 2022-10-27 – 2 CVE-2023-28321: IDN wildcard match #1950627 Valid Cryptography Low 2023-05-18 – 2 CVE-2026-8286: wrong STARTTLS connection reuse #3718195 Valid No weakness recorded Low 2026-06-24 – 2 CVE-2026-8458: wrong reuse for different services #3721183 Valid Authentication Low 2026-06-24 – 2 CVE-2026-8926: password leak with netrc and user in URL #3735184 Valid Information Disclosure Low 2026-06-24 – 2 CVE-2026-8925: SASL double-free #3735193 Valid Memory Corruption Medium 2026-06-24 – 2 CVE-2026-9547: SSH improper host validation #3751712 Valid Cryptography – 2026-06-24 – 2 CVE-2026-11856: cross-origin Digest auth state leak #3793260 Valid Information Disclosure Medium 2026-06-24 – 2 CVE-2026-87866: wolfSSL public-key pinning bypass #3989514 Valid Cryptography Medium 2026-10-14 – 2 CVE-2026-86415: auto client cert connection reuse mixup #3993870 Valid No weakness recorded Low 2026-10-14 – 2 CVE-2026-92391: curl_mime_free stack overflow by recursion #4024222 Valid No weakness recorded None 2026-10-14 – 2 CVE-2026-111878: OpenSSL provider UAF on TLS shutdown #4116527 Valid Memory Corruption Low 2026-10-26 – 2 CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass #4122300 Valid Cryptography Low 2026-10-26 – 2 CVE-2020-8285: FTP wildcard stack overflow #1045844 Valid Denial of Service Medium 2021-01-08 – 3 CVE-2021-22925: TELNET stack contents disclosure again #1223882 Valid Information Disclosure Low 2021-07-21 – 3 CVE-2022-32221: POST following PUT confusion #1704017 Valid Input Validation and Logic Medium 2022-11-26 – 3 CVE-2023-27534: SFTP path ~ resolving discrepancy #1892351 Valid File and Path Handling Low 2023-03-22 – 3 CVE-2023-28322: more POST-after-PUT confusion #1954658 Valid Input Validation and Logic Low 2023-05-18 – 3 CVE-2026-8932: incomplete mTLS config matching in conn reuse #3733910 Valid Input Validation and Logic Low 2026-06-24 – 3 CVE-2026-8927: env-set cross-proxy Digest auth state leak #3744543 Valid Authentication Medium 2026-06-24 – 3 CVE-2026-9080: UAF after pause in socket callback #3749204 Valid Memory Corruption Low 2026-06-24 – 3 CVE-2026-9545: exposing HTTP/3 early data #3752888 Valid Cryptography Low 2026-06-24 – 3 CVE-2026-9546: sending old referer #3754343 Valid Memory Corruption Low 2026-06-24 – 3 CVE-2026-87863: HSTS response erases persisted entries #3972373 Valid Race Conditions – 2026-10-14 – 3 CVE-2026-82208: wolfSSL CA-cache hit overrides callback #3973090 Valid Cryptography – 2026-09-03 – 3