https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:50:53 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-80255 <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-80255 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1108 certfr-2026-avi-1108 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1108 https://cve.radiocsirt.org/vuln/euvd-2026-368423 EUVD-2026-368423 https://cve.radiocsirt.org/vuln/euvd-2026-368423 https://cve.radiocsirt.org/vuln/fkie_cve-2026-80255 <p>A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.</p> <p>A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-80255 https://cve.radiocsirt.org/vuln/ghsa-vmmm-3jqx-jgx8 <p>A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.</p> <p>A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.</p> https://cve.radiocsirt.org/vuln/ghsa-vmmm-3jqx-jgx8 https://cve.radiocsirt.org/vuln/msrc_cve-2026-80255 msrc_CVE-2026-80255 https://cve.radiocsirt.org/vuln/msrc_cve-2026-80255 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11696-1 <p>curl-8.22.0-1.1 on GA media</p> <p>curl-8.22.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11696-1 https://cve.radiocsirt.org/vuln/rhsa-2026:63161 <p>curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication curl: curl: Public key pinning bypass allows unauthenticated connections curl: curl: Incorrect HTTPS connection reuse with Native CA Store curl: curl: Information disclosure due to secure cookie attribute bypass curl: libcurl: Information disclosure via improper Public Suffix List boundary check</p> <p>curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication curl: curl: Public key pinning bypass allows unauthenticated connections curl: curl: Incorrect HTTPS connection reuse with Native CA Store curl: curl: Information disclosure due to secure cookie attribute bypass curl: libcurl: Information disclosure via improper Public Suffix List boundary check</p> https://cve.radiocsirt.org/vuln/rhsa-2026:63161 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-80255 <p><strong>Affected:</strong> Ubuntu:26.04:LTS: curl</p> <p>A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.</p> <p><strong>Affected:</strong> Ubuntu:26.04:LTS: curl</p> <p>A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-80255 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3149 <p>Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein entfernter Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3149