The Curl project reports:
- local interface connection reuse mixup (CVE-2026-107929)
- info leak uploading over WebSockets with GnuTLS (CVE-2026-107928)
- password leak in CURLINFO_EFFECTIVE_URL (CVE-2026-94266)
- Authorization: Negotiate sent to foreign origin (CVE-2026-94265)
- server-set cookie aborts cookie jar load (CVE-2026-92386)
- never-ending loop via server response omission (CVE-2026-92387)
- FTP wildcard write callback mixup (CVE-2026-92388)
- TFTP direction confusion (CVE-2026-92389)
- -J no-clobber guarantee bypassed with 103 early hints (CVE-2026-92390)
- curl_mime_free stack overflow by recursion (CVE-2026-92391)
- HTTP/2 upload Use-After-Free (CVE-2026-92392)
- redirect to SFTP or SCP bypasses host verification (CVE-2026-86410)
- server-set cookie erases cookie jar (CVE-2026-86412)
- Negotiate credentials sent to redirected origin (CVE-2026-86413)
- leaking host credentials to HTTP proxy (CVE-2026-86414)
- auto client cert connection reuse mixup (CVE-2026-86415)
- cross-origin reuse of a Negotiate connection (CVE-2026-87861)
- HSTS cache import drops longer-lived child (CVE-2026-87862)
- HSTS response erases persisted entries (CVE-2026-87863)
- knownhost callback mismatches key as missing (CVE-2026-87865)
- wolfSSL public-key pinning bypass (CVE-2026-87866)