# page
# first vulnerable version
# last vulnerable version
# name
# CVE
# announce date (YYYYMMDD)
# report to the project date (YYYYMMDD),
# CWE
# award money (USD)
# area (single word)
# C-issue (-, OVERFLOW, OVERREAD, DOUBLE_FREE, USE_AFTER_FREE, NULL_MISTAKE,
#          UNINIT, BAD_FREE)
# tool/lib: both, lib, tool
# severity: low, medium, high, critical
# issue: URL to the original report
#
# List of CWEs => https://cwe.mitre.org/data/definitions/658.html
@vuln = (
    "CVE-2026-107929.html|8.9.0|8.22.0|local interface connection reuse mixup|CVE-2026-107929|20261014|20261009|CWE-488: Exposure of Data Element to Wrong Session|0|connreuse|-|both|low|https://hackerone.com/reports/4099618",
    "CVE-2026-107928.html|7.86.0|8.22.0|info leak uploading over WebSockets with GnuTLS|CVE-2026-107928|20261014|20261009|CWE-126: Buffer Over-read|0|WebSocket|OVERREAD|both|low|https://hackerone.com/reports/4099194",
    "CVE-2026-94266.html|7.62.0|8.22.0|password leak in CURLINFO_EFFECTIVE_URL|CVE-2026-94266|20261014|20260918|CWE-522: Insufficiently Protected Credentials|0|URL|-|both|low|https://hackerone.com/reports/4041053",
    "CVE-2026-94265.html|8.21.0|8.22.0|Authorization: Negotiate sent to foreign origin|CVE-2026-94265|20261014|20260915|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|0|connreuse|-|both|low|https://hackerone.com/reports/4040551",
    "CVE-2026-92386.html|8.7.0|8.22.0|server-set cookie aborts cookie jar load|CVE-2026-92386|20261014|20260911|CWE-1284: Improper Validation of Specified Quantity in Input|0|cookie|-|both|low|https://hackerone.com/reports/4021979",
    "CVE-2026-92387.html|8.10.0|8.22.0|never-ending loop via server response omission|CVE-2026-92387|20261014|20260911|CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')|0|pingpong|-|both|low|https://hackerone.com/reports/4022003",
    "CVE-2026-92388.html|7.21.0|8.22.0|FTP wildcard write callback mixup|CVE-2026-92388|20261014|20260911|CWE-416: Use After Free|0|FTP|USE_AFTER_FREE|lib|low|https://hackerone.com/reports/4022070",
    "CVE-2026-92389.html|7.15.0|8.22.0|TFTP direction confusion|CVE-2026-92389|20261014|20260911|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|0|TFTP|-|lib|low|https://hackerone.com/reports/4022568",
    "CVE-2026-92390.html|7.20.0|8.22.0|-J no-clobber guarantee bypassed with 103 early hints|CVE-2026-92390|20261014|20260912|CWE-73: External Control of File Name or Path|0|tool|-|tool|low|https://hackerone.com/reports/4023192",
    "CVE-2026-92391.html|7.56.0|8.22.0|curl_mime_free stack overflow by recursion|CVE-2026-92391|20261014|20260912|CWE-674: Uncontrolled Recursion|0|mime|-|lib|low|https://hackerone.com/reports/4024222",
    "CVE-2026-92392.html|8.12.0|8.22.0|HTTP/2 upload Use-After-Free|CVE-2026-92392|20261014|20260915|CWE-416: Use After Free|0|HTTP/2|USE_AFTER_FREE|both|high|https://hackerone.com/reports/4030333",

    "CVE-2026-86410.html|7.81.0|8.22.0|redirect to SFTP or SCP bypasses host verification|CVE-2026-86410|20261014|20260827|CWE-297: Improper Validation of Certificate with Host Mismatch|0|SSH|-|tool|low|https://hackerone.com/reports/3973176",
    "CVE-2026-86412.html|8.18.0|8.22.0|server-set cookie erases cookie jar|CVE-2026-86412|20261014|20260827|CWE-754: Improper Check for Unusual or Exceptional Conditions|0|cookies|-|both|low|https://hackerone.com/reports/3973201",
    "CVE-2026-86413.html|8.21.0|8.22.0|Negotiate credentials sent to redirected origin|CVE-2026-86413|20261014|20260903|CWE-201: Information Exposure Through Sent Data|0|auth|-|both|low|https://hackerone.com/reports/3993549",
    "CVE-2026-86414.html|7.10.8|8.22.0|leaking host credentials to HTTP proxy|CVE-2026-86414|20261014|20260903|CWE-201: Information Exposure Through Sent Data|0|proxy|-|both|low|https://hackerone.com/reports/3993566",
    "CVE-2026-86415.html|8.21.0|8.22.0|auto client cert connection reuse mixup|CVE-2026-86415|20261014|20260903|CWE-201: Information Exposure Through Sent Data|0|connreuse|-|both|low|https://hackerone.com/reports/3993870",
    "CVE-2026-87861.html|8.21.0|8.22.0|cross-origin reuse of a Negotiate connection|CVE-2026-87861|20261014|20260826|CWE-201: Information Exposure Through Sent Data|0|connreuse|-|both|low|https://hackerone.com/reports/3972094",
    "CVE-2026-87862.html|8.11.0|8.22.0|HSTS cache import drops longer-lived child|CVE-2026-87862|20261014|20260826|CWE-201: Information Exposure Through Sent Data|0|HSTS|-|both|low|https://hackerone.com/reports/3972357",
    "CVE-2026-87863.html|8.2.0|8.22.0|HSTS response erases persisted entries|CVE-2026-87863|20261014|20260826|CWE-201: Information Exposure Through Sent Data|0|HSTS|-|both|low|https://hackerone.com/reports/3972373",
    "CVE-2026-87865.html|7.69.1|8.22.0|knownhost callback mismatches key as missing|CVE-2026-87865|20261014|20260828|CWE-295: Improper Certificate Validation|0|SSH|-|both|low|https://hackerone.com/reports/3975408",
    "CVE-2026-87866.html|7.43.0|8.22.0|wolfSSL public-key pinning bypass|CVE-2026-87866|20261014|20260902|CWE-295: Improper Certificate Validation|0|TLS|-|both|low|https://hackerone.com/reports/3989514",
    "CVE-2026-86409.html|7.75.0|8.21.0|stale SigV4 headers sent unintended|CVE-2026-86409|20261014|20260827|CWE-201: Information Exposure Through Sent Data|0|sigv4|-|lib|low|https://hackerone.com/reports/3973135",
    "CVE-2026-86411.html|8.21.0|8.21.0|FTP connection reuse inherits client-certificate|CVE-2026-86411|20261014|20260827|CWE-488: Exposure of Data Element to Wrong Session|0|connreuse|-|both|low|https://hackerone.com/reports/3973190",
    "CVE-2026-87864.html|7.30.0|8.21.0|IMAP APPEND plus CRLF conversion command injection|CVE-2026-87864|20261014|20260826|CWE-130: Improper Handling of Length Parameter Inconsistency|0|IMAP|-|both|low|https://hackerone.com/reports/3972403",
    "CVE-2026-82209.html|7.46.0|8.21.0|domain-scoped PSL domain cookie|CVE-2026-82209|20260902|20260826|CWE-201: Information Exposure Through Sent Data|0|cookie|-|both|low|https://hackerone.com/reports/3972385",
    "CVE-2026-82208.html|8.9.1|8.21.0|wolfSSL CA-cache hit overrides callback|CVE-2026-82208|20260902|20260826|CWE-295: Improper Certificate Validation|0|TLS|-|lib|low|https://hackerone.com/reports/3973090",
    "CVE-2026-80255.html|8.13.0|8.21.0|secure cookie attribute bypass with tab|CVE-2026-80255|20260902|20260826|CWE-201: Information Exposure Through Sent Data|0|cookie|-|both|low|https://hackerone.com/reports/3972395",
    "CVE-2026-80231.html|7.71.0|8.21.0|native CA store conn reuse|CVE-2026-80231|20260902|20260824|CWE-488: Exposure of Data Element to Wrong Session|0|reuse|-|both|low|https://hackerone.com/reports/3969368",
    "CVE-2026-80230.html|7.45.0|8.21.0|OpenSSL pinning bypass|CVE-2026-80230|20260902|20260824|CWE-295: Improper Certificate Validation|0|TLS|-|both|low|https://hackerone.com/reports/3969300",
    "CVE-2026-80229.html|8.14.0|8.21.0|OpenSSL provider use-after-free|CVE-2026-80229|20260902|20260824|CWE-416: Use After Free|0|OpenSSL|USE_AFTER_FREE|both|low|https://hackerone.com/reports/3969255",
    "CVE-2026-19931.html|7.64.1|8.21.0|Negotiate ambient user conn reuse|CVE-2026-19931|20260902|20260807|CWE-488: Exposure of Data Element to Wrong Session|0|Negotiate|-|both|medium|https://hackerone.com/reports/3923520",
    "CVE-2026-18924.html|7.44.0|8.21.0|HTTP/2 server push UAF|CVE-2026-18924|20260902|20260805|CWE-416: Use After Free|0|HTTP/2|USE_AFTER_FREE|lib|low|https://hackerone.com/reports/3916059",
    "CVE-2026-13608.html|7.82.0|8.21.0|OpenLDAP SASL authentication bypass|CVE-2026-13608|20260902|20260624|CWE-923: Improper Restriction of Communication Channel to Intended Endpoints|0|LDAP|-|both|low|https://hackerone.com/reports/3822248",
    "CVE-2026-12064.html|7.81.0|8.20.0|proto-default skips SSH verification|CVE-2026-12064|20260624|20260612|CWE-297: Improper Validation of Certificate with Host Mismatch|0|SSH|-|tool|low|https://hackerone.com/reports/3797526",
    "CVE-2026-11856.html|7.10.6|8.20.0|cross-origin Digest auth state leak|CVE-2026-11856|20260624|20260610|CWE-294: Authentication Bypass by Capture-replay|0|Digest|-|lib|medium|https://hackerone.com/reports/3793260",
    "CVE-2026-11586.html|8.16.0|8.20.0|WS Auto-PONG memory exhaustion|CVE-2026-11586|20260624|20260608|CWE-770: Allocation of Resources Without Limits or Throttling|0|WebSocket|-|both|low|https://hackerone.com/reports/3788931",
    "CVE-2026-11564.html|8.17.0|8.20.0|Native CA trust persist|CVE-2026-11564|20260624|20260605|CWE-295: Improper Certificate Validation|0|TLS|-|lib|low|https://hackerone.com/reports/3788984",
    "CVE-2026-11352.html|8.18.0|8.20.0|QUIC zero-length UDP datagrams busy-loop|CVE-2026-11352|20260624|20260605|CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')|0|HTTP/3|-|both|low|https://hackerone.com/reports/3783438",
    "CVE-2026-10536.html|7.88.0|8.20.0|HTTP/2 stream-dependency tree UAF|CVE-2026-10536|20260624|20260520|CWE-416: Use After Free|0|HTTP/2|USE_AFTER_FREE|lib|low|https://hackerone.com/reports/3751697",
    "CVE-2026-9547.html|7.69.0|8.20.0|SSH improper host validation|CVE-2026-9547|20260624|20260520|CWE-297: Improper Validation of Certificate with Host Mismatch|0|SSH|-|lib|low|https://hackerone.com/reports/3751712",
    "CVE-2026-9546.html|8.18.0|8.20.0|sending old referer|CVE-2026-9546|20260624|20260522|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|0|HTTP|-|lib|low|https://hackerone.com/reports/3754343",
    "CVE-2026-9545.html|8.11.0|8.20.0|exposing HTTP/3 early data|CVE-2026-9545|20260624|20260519|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|0|HTTP/3|-|both|low|https://hackerone.com/reports/3752888",
    "CVE-2026-9080.html|8.13.0|8.20.0|UAF after pause in socket callback|CVE-2026-9080|20260624|20260519|CWE-416: Use After Free|0|event-based|USE_AFTER_FREE|lib|low|https://hackerone.com/reports/3749204",
    "CVE-2026-9079.html|8.8.0|8.20.0|stale proxy password leak|CVE-2026-9079|20260624|20260520|CWE-522: Insufficiently Protected Credentials|0|proxy|-|lib|medium|https://hackerone.com/reports/3750295",
    "CVE-2026-8932.html|7.7|8.20.0|incomplete mTLS config matching in conn reuse|CVE-2026-8932|20260624|20260513|CWE-305: Authentication Bypass by Primary Weakness|0|reuse|-|lib|low|https://hackerone.com/reports/3733910",
    "CVE-2026-8927.html|7.12.0|8.20.0|env-set cross-proxy Digest auth state leak|CVE-2026-8927|20260624|20260518|CWE-294: Authentication Bypass by Capture-replay|0|proxy|-|lib|medium|https://hackerone.com/reports/3744543",
    "CVE-2026-8926.html|8.11.1|8.20.0|password leak with netrc and user in URL|CVE-2026-8926|20260624|20260524|CWE-522: Insufficiently Protected Credentials|0|netrc|-|both|low|https://hackerone.com/reports/3735184",
    "CVE-2026-8925.html|8.15.0|8.20.0|SASL double-free|CVE-2026-8925|20260624|20260514|CWE-415: Double Free|0|SASL|DOUBLE_FREE|both|medium|https://hackerone.com/reports/3735193",
    "CVE-2026-8924.html|7.46.0|8.20.0|trailing dot domain super cookie|CVE-2026-8924|20260624|20260513|CWE-201: Information Exposure Through Sent Data|0|cookie|-|both|low|https://hackerone.com/reports/3733905",
    "CVE-2026-8458.html|7.43.0|8.20.0|wrong reuse for different services|CVE-2026-8458|20260624|20260508|CWE-488: Exposure of Data Element to Wrong Session|0|connreuse|-|both|low|https://hackerone.com/reports/3721183",
    "CVE-2026-8286.html|7.30.0|8.20.0|wrong STARTTLS connection reuse|CVE-2026-8286|20260624|20260506|CWE-295: Improper Certificate Validation|0|connreuse|-|both|low|https://hackerone.com/reports/3718195",
    "CVE-2026-7168.html|7.12.0|8.19.0|cross-proxy Digest auth state leak|CVE-2026-7168|20260429|20260427|CWE-294: Authentication Bypass by Capture-replay|0|proxy|-|lib|medium|https://hackerone.com/reports/3697719",
    "CVE-2026-7009.html|8.17.0|8.19.0|OCSP stapling bypass with Apple SecTrust|CVE-2026-7009|20260429|20260425|CWE-295: Improper Certificate Validation|0|OCSP|-|both|medium|https://hackerone.com/reports/3694390",
    "CVE-2026-6429.html|7.14.0|8.19.0|netrc credential leak with reused proxy connection|CVE-2026-6429|20260429|20260416|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|0|connreuse|-|lib|medium|https://hackerone.com/reports/3677759",
    "CVE-2026-6276.html|7.71.0|8.19.0|stale custom cookie host causes cookie leak|CVE-2026-6276|20260429|20260414|CWE-346: Origin Validation Error|0|cookie|-|lib|low|https://hackerone.com/reports/3671818",
    "CVE-2026-6253.html|7.14.1|8.19.0|proxy credentials leak over redirect-to proxy|CVE-2026-6253|20260429|20260413|CWE-522: Insufficiently Protected Credentials|0|proxy|-|both|medium|https://hackerone.com/reports/3669637",
    "CVE-2026-5773.html|7.40.0|8.19.0|wrong reuse of SMB connection|CVE-2026-5773|20260429|20260405|CWE-488: Exposure of Data Element to Wrong Session|0|CONNREUSE|-|both|low|https://hackerone.com/reports/3650689",
    "CVE-2026-5545.html|7.10.6|8.19.0|wrong reuse of HTTP Negotiate connection|CVE-2026-5545|20260429|20260401|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|medium|https://hackerone.com/reports/3642555",
    "CVE-2026-4873.html|7.20.0|8.19.0|connection reuse ignores TLS requirement|CVE-2026-4873|20260429|20260322|CWE-319: Cleartext Transmission of Sensitive Information|0|CONNREUSE|-|both|low|https://hackerone.com/reports/3621851",
    "CVE-2026-3805.html|8.13.0|8.18.0|use after free in SMB connection reuse|CVE-2026-3805|20260311|20260308|CWE-416: Use After Free|0|SMB|USE_AFTER_FREE|both|medium|https://hackerone.com/reports/3591944",
    "CVE-2026-3784.html|7.7|8.18.0|wrong proxy connection reuse with credentials|CVE-2026-3784|20260311|20260304|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|low|https://hackerone.com/reports/3584903",
    "CVE-2026-3783.html|7.33.0|8.18.0|token leak with redirect and netrc|CVE-2026-3783|20260311|20260303|CWE-522: Insufficiently Protected Credentials|0|AUTH|-|both|medium|https://hackerone.com/reports/3583983",
    "CVE-2026-1965.html|7.10.6|8.18.0|bad reuse of HTTP Negotiate connection|CVE-2026-1965|20260311|20260204|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|medium",
    "CVE-2025-15224.html|7.58.0|8.17.0|libssh key passphrase bypass without agent set|CVE-2025-15224|20260107|20251228|CWE-287: Improper Authentication|505|SSH|-|both|low|https://hackerone.com/reports/3480925",
    "CVE-2025-15079.html|7.58.0|8.17.0|libssh global known_hosts override|CVE-2025-15079|20260107|20251224|CWE-297: Improper Validation of Certificate with Host Mismatch|505|SSH|-|both|low|https://hackerone.com/reports/3477116",
    "CVE-2025-14819.html|7.87.0|8.17.0|OpenSSL partial chain store policy bypass|CVE-2025-14819|20260107|20251216|CWE-295: Improper Certificate Validation|505|TLS|-|lib|low",
    "CVE-2025-14524.html|7.33.0|8.17.0|bearer token leak on cross-protocol redirect|CVE-2025-14524|20260107|20251209|CWE-522: Insufficiently Protected Credentials|505|AUTH|-|both|low|https://hackerone.com/reports/3459417",
    "CVE-2025-14017.html|7.17.0|8.17.0|broken TLS options for threaded LDAPS|CVE-2025-14017|20260107|20251201|CWE-567: Unsynchronized Access to Shared Data in a Multi-threaded Context|2540|LDAP|-|lib|medium",
    "CVE-2025-13034.html|8.8.0|8.17.0|No QUIC certificate pinning with GnuTLS|CVE-2025-13034|20260107|20251109|CWE-295: Improper Certificate Validation|2540|QUIC|-|both|medium",
    "CVE-2025-10966.html|7.69.0|8.16.0|missing SFTP host verification with wolfSSH|CVE-2025-10966|20251105|20250923|CWE-322: Key Exchange without Entity Authentication|505|SSH|-|both|low|https://hackerone.com/reports/3355218",
    "CVE-2025-10148.html|8.11.0|8.15.0|predictable WebSocket mask|CVE-2025-10148|20250910|20250908|CWE-340: Generation of Predictable Numbers or Identifiers|505|WebSocket|-|both|low|https://hackerone.com/reports/3330839",
    "CVE-2025-9086.html|8.13.0|8.15.0|Out of bounds read for cookie path|CVE-2025-9086|20250910|20250811|CWE-125: Out-of-bounds Read|505|cookies|OVERREAD|lib|low|https://hackerone.com/reports/3294999",
    "CVE-2025-5399.html|8.13.0|8.14.0|WebSocket endless loop|CVE-2025-5399|20250604|20250530|CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')|505|WebSocket|-|lib|low|https://hackerone.com/reports/3168039",
    "CVE-2025-5025.html|8.5.0|8.13.0|No QUIC certificate pinning with wolfSSL|CVE-2025-5025|20250528|20250519|CWE-295: Improper Certificate Validation|2540|TLS|-|both|medium|https://hackerone.com/reports/3153497",
    "CVE-2025-4947.html|8.8.0|8.13.0|QUIC certificate check skip with wolfSSL|CVE-2025-4947|20250528|20250517|CWE-295: Improper Certificate Validation|2540|TLS|-|both|medium|https://hackerone.com/reports/3150884",
    "CVE-2025-0725.html|7.10.5|8.11.1|gzip integer overflow|CVE-2025-0725|20250205|20250123|CWE-680: Integer Overflow to Buffer Overflow|505|gzip|OVERFLOW|both|low|https://hackerone.com/reports/2956023",
    "CVE-2025-0665.html|8.11.1|8.11.1|eventfd double close|CVE-2025-0665|20250205|20250122|CWE-1341: Multiple Releases of Same Resource or Handle|505|DNS|-|both|low|https://hackerone.com/reports/2954286",
    "CVE-2025-0167.html|7.76.0|8.11.1|netrc and default credential leak|CVE-2025-0167|20250205|20241230|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|505|netrc|-|both|low|https://hackerone.com/reports/2917232",
    "CVE-2024-11053.html|7.76.0|8.11.0|netrc and redirect credential leak|CVE-2024-11053|20241211|20241108|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|505|netrc|-|both|low|https://hackerone.com/reports/2829063",
    "CVE-2024-9681.html|7.74.0|8.10.1|HSTS subdomain overwrites parent cache entry|CVE-2024-9681|20241106|20241007|CWE-1025: Comparison Using Wrong Factors|540|HSTS|-|both|low|https://hackerone.com/reports/2764830",
    "CVE-2024-8096.html|7.41.0|8.9.1|OCSP stapling bypass with GnuTLS|CVE-2024-8096|20240911|20240819|CWE-295: Improper Certificate Validation|2540|TLS|-|both|medium|https://hackerone.com/reports/2669852",
    "CVE-2024-7264.html|7.32.0|8.9.0|ASN.1 date parser overread|CVE-2024-7264|20240731|20240730|CWE-125: Out-of-bounds Read|540|ASN1|OVERREAD|both|low|https://hackerone.com/reports/2629968",
    "CVE-2024-6874.html|8.8.0|8.8.0|macidn punycode buffer overread|CVE-2024-6874|20240724|20240716|CWE-126: Buffer Over-read|540|IDN|OVERREAD|lib|low|https://hackerone.com/reports/2604391",
    "CVE-2024-6197.html|8.6.0|8.8.0|freeing stack buffer in utf8asn1str|CVE-2024-6197|20240724|20240619|CWE-590: Free of Memory not on the Heap|2540|ASN1|BAD_FREE|both|medium|https://hackerone.com/reports/2559516",
    "CVE-2024-2466.html|8.5.0|8.6.0|TLS certificate check bypass with mbedTLS|CVE-2024-2466|20240327|20240314|CWE-297: Improper Validation of Certificate with Host Mismatch|2540|TLS|-|both|medium|https://hackerone.com/reports/2416725",
    "CVE-2024-2398.html|7.44.0|8.6.0|HTTP/2 push headers memory-leak|CVE-2024-2398|20240327|20240305|CWE-772: Missing Release of Resource after Effective Lifetime|2540|HTTP/2|-|lib|medium|https://hackerone.com/reports/2402845",
    "CVE-2024-2379.html|8.6.0|8.6.0|QUIC certificate check bypass with wolfSSL|CVE-2024-2379|20240327|20240310|CWE-295: Improper Certificate Validation|540|QUIC|-|both|low|https://hackerone.com/reports/2410774",
    "CVE-2024-2004.html|7.85.0|8.6.0|Usage of disabled protocol|CVE-2024-2004|20240327|20240215|CWE-115: Misinterpretation of Input|540|control|-|both|low|https://hackerone.com/reports/2384833",
    "CVE-2024-0853.html|8.5.0|8.5.0|OCSP verification bypass with TLS session reuse|CVE-2024-0853|20240131|20231229|CWE-299: Improper Check for Certificate Revocation|540|TLS|-|both|low|https://hackerone.com/reports/2298922",
    "CVE-2023-46219.html|7.84.0|8.4.0|HSTS long filename clears contents|CVE-2023-46219|20231206|20231102|CWE-311: Missing Encryption of Sensitive Data|540|HSTS|-|both|low|https://hackerone.com/reports/2236133",
    "CVE-2023-46218.html|7.46.0|8.4.0|cookie mixed case PSL bypass|CVE-2023-46218|20231206|20231017|CWE-201: Information Exposure Through Sent Data|2540|cookie|-|both|medium|https://hackerone.com/reports/2212193",
    "CVE-2023-38546.html|7.9.1|8.3.0|cookie injection with none file|CVE-2023-38546|20231011|20230914|CWE-73: External Control of filename or Path|540|cookies|-|lib|low|https://hackerone.com/reports/2148242",
    "CVE-2023-38545.html|7.69.0|8.3.0|SOCKS5 heap buffer overflow|CVE-2023-38545|20231011|20230930|CWE-122: Heap-based Buffer Overflow|4660|SOCKS5|OVERFLOW|both|high|https://hackerone.com/reports/2187833",
    "CVE-2023-38039.html|7.84.0|8.2.1|HTTP headers eat all memory|CVE-2023-38039|20230913|20230717|CWE-770: Allocation of Resources Without Limits or Throttling|2540|HTTP|-|both|medium|https://hackerone.com/reports/2072338",
    # CVE-2023-32001 is no longer considered a security problem
    "CVE-2023-28322.html|7.7|8.0.1|more POST-after-PUT confusion|CVE-2023-28322|20230517|20230419|CWE-440: Expected Behavior Violation|480|HTTP|-|lib|low|https://hackerone.com/reports/1954658",
    "CVE-2023-28321.html|7.12.0|8.0.1|IDN wildcard match|CVE-2023-28321|20230517|20230417|CWE-295: Improper Certificate Validation|480|TLS|-|both|low|https://hackerone.com/reports/1950627",
    "CVE-2023-28320.html|7.9.8|8.0.1|siglongjmp race condition|CVE-2023-28320|20230517|20230402|CWE-662: Improper Synchronization|480|DNS|-|lib|low|https://hackerone.com/reports/1929597",
    "CVE-2023-28319.html|7.81.0|8.0.1|UAF in SSH sha256 fingerprint check|CVE-2023-28319|20230517|20230321|CWE-416: Use After Free|2400|SSH|USE_AFTER_FREE|both|medium|https://hackerone.com/reports/1913733",
    "CVE-2023-27538.html|7.16.1|7.88.1|SSH connection too eager reuse still|CVE-2023-27538|20230320|20230309|CWE-305: Authentication Bypass by Primary Weakness|480|CONNREUSE|-|both|low|https://hackerone.com/reports/1898475",
    "CVE-2023-27537.html|7.88.0|7.88.1|HSTS double free|CVE-2023-27537|20230320|20230308|CWE-415: Double Free|480|HSTS|DOUBLE_FREE|lib|low|https://hackerone.com/reports/1897203",
    "CVE-2023-27536.html|7.22.0|7.88.1|GSS delegation too eager connection reuse|CVE-2023-27536|20230320|20230307|CWE-305: Authentication Bypass by Primary Weakness|480|CONNREUSE|-|lib|low|https://hackerone.com/reports/1895135",
    "CVE-2023-27535.html|7.13.0|7.88.1|FTP too eager connection reuse|CVE-2023-27535|20230320|20230305|CWE-305: Authentication Bypass by Primary Weakness|2400|CONNREUSE|-|both|medium|https://hackerone.com/reports/1892780",
    "CVE-2023-27534.html|7.18.0|7.88.1|SFTP path ~ resolving discrepancy|CVE-2023-27534|20230320|20230305|CWE-22: Improper Limitation of a Pathname to a Restricted Directory|480|SFTP|-|both|low|https://hackerone.com/reports/1892351",
    "CVE-2023-27533.html|7.7|7.88.1|TELNET option IAC injection|CVE-2023-27533|20230320|20230303|CWE-75: Failure to Sanitize Special Elements into a Different Plane|480|TELNET|-|both|low|https://hackerone.com/reports/1891474",
    "CVE-2023-23916.html|7.57.0|7.87.0|HTTP multi-header compression denial of service|CVE-2023-23916|20230215|20230108|CWE-770: Allocation of Resources Without Limits or Throttling|2400|compression|-|both|medium|https://hackerone.com/reports/1826048",
    "CVE-2023-23915.html|7.77.0|7.87.0|HSTS amnesia with --parallel|CVE-2023-23915|20230215|20221221|CWE-319: Cleartext Transmission of Sensitive Information|480|HSTS|-|both|low|https://hackerone.com/reports/1814333",
    "CVE-2023-23914.html|7.77.0|7.87.0|HSTS ignored on multiple requests|CVE-2023-23914|20230215|20221221|CWE-319: Cleartext Transmission of Sensitive Information|480|HSTS|-|both|low|https://hackerone.com/reports/1813864",
    "CVE-2022-43552.html|7.16.0|7.86.0|HTTP Proxy deny use after free|CVE-2022-43552|20221221|20221107|CWE-416: Use After Free|0|proxy|USE_AFTER_FREE|both|low|https://hackerone.com/reports/1764858",
    "CVE-2022-43551.html|7.77.0|7.86.0|Another HSTS bypass via IDN|CVE-2022-43551|20221221|20221029|CWE-319: Cleartext Transmission of Sensitive Information|2400|URL|-|both|medium|https://hackerone.com/reports/1755083",
    "CVE-2022-42916.html|7.77.0|7.85.0|HSTS bypass via IDN|CVE-2022-42916|20221026|20221011|CWE-319: Cleartext Transmission of Sensitive Information|2400|URL|-|both|medium|https://hackerone.com/reports/1730660",
    "CVE-2022-42915.html|7.77.0|7.85.0|HTTP proxy double free|CVE-2022-42915|20221026|20221004|CWE-415: Double Free|0|proxy|DOUBLE_FREE|both|medium|https://hackerone.com/reports/1722065",
    "CVE-2022-35260.html|7.84.0|7.85.0|.netrc parser out-of-bounds access|CVE-2022-35260|20221026|20221004|CWE-121: Stack-based Buffer Overflow|480|NETRC|OVERFLOW|both|low|https://hackerone.com/reports/1721098",
    "CVE-2022-32221.html|7.7|7.85.0|POST following PUT confusion|CVE-2022-32221|20221026|20220919|CWE-440: Expected Behavior Violation|2400|HTTP|-|lib|medium|https://hackerone.com/reports/1704017",
    "CVE-2022-35252.html|4.9|7.84.0|control code in cookie denial of service|CVE-2022-35252|20220831|20220626|CWE-1286: Improper Validation of Syntactic Correctness of Input|480|cookies|-|both|low|https://hackerone.com/reports/1613943",
    "CVE-2022-32208.html|7.16.4|7.83.1|FTP-KRB bad message verification|CVE-2022-32208|20220627|20220602|CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel|480|FTP|-|both|low|https://hackerone.com/reports/1590071",
    "CVE-2022-32207.html|7.69.0|7.83.1|Non-preserved file permissions|CVE-2022-32207|20220627|20220517|CWE-281: Improper Preservation of Permissions|2400|filesystem|-|both|medium|https://hackerone.com/reports/1573634",
    "CVE-2022-32206.html|7.57.0|7.83.1|HTTP compression denial of service|CVE-2022-32206|20220627|20220515|CWE-770: Allocation of Resources Without Limits or Throttling|2400|compression|-|both|medium|https://hackerone.com/reports/1570651",
    "CVE-2022-32205.html|7.71.0|7.83.1|Set-Cookie denial of service|CVE-2022-32205|20220627|20220513|CWE-770: Allocation of Resources Without Limits or Throttling|480|cookies|-|both|low|https://hackerone.com/reports/1569946",
    "CVE-2022-30115.html|7.82.0|7.83.0|HSTS bypass via trailing dot|CVE-2022-30115|20220511|20220503|CWE-319: Cleartext Transmission of Sensitive Information|2400|URL|-|both|medium|https://hackerone.com/reports/1557449",
    "CVE-2022-27782.html|7.16.1|7.83.0|TLS and SSH connection too eager reuse|CVE-2022-27782|20220511|20220501|CWE-305: Authentication Bypass by Primary Weakness|2400|CONNREUSE|-|both|medium|https://hackerone.com/reports/1555796",
    "CVE-2022-27781.html|7.34.0|7.83.0|CERTINFO never-ending busy-loop|CVE-2022-27781|20220511|20220430|CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')|0|TLS|-|lib|low|https://hackerone.com/reports/1555441",
    "CVE-2022-27780.html|7.80.0|7.83.0|percent-encoded path separator in URL host|CVE-2022-27780|20220511|20220428|CWE-177: Improper Handling of URL Encoding|2400|URL|-|both|medium|https://hackerone.com/reports/1553841",
    "CVE-2022-27779.html|7.82.0|7.83.0|cookie for trailing dot TLD|CVE-2022-27779|20220511|20220428|CWE-201: Information Exposure Through Sent Data|2400|COOKIE|-|both|medium|https://hackerone.com/reports/1553301",
    "CVE-2022-27778.html|7.83.0|7.83.0|curl removes wrong file on error|CVE-2022-27778|20220511|20220428|CWE-706: Use of Incorrectly-Resolved Name or Reference|2400|FILE|-|tool|medium|https://hackerone.com/reports/1553598",
    "CVE-2022-27776.html|4.9|7.82.0|Auth/cookie leak on redirect|CVE-2022-27776|20220427|20220421|CWE-522: Insufficiently Protected Credentials|480|HTTP|-|both|low|https://hackerone.com/reports/1547048",
    "CVE-2022-27775.html|7.65.0|7.82.0|Bad local IPv6 connection reuse|CVE-2022-27775|20220427|20220421|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|480|CONNREUSE|-|both|low|https://hackerone.com/reports/1546268",
    "CVE-2022-27774.html|4.9|7.82.0|Credential leak on redirect|CVE-2022-27774|20220427|20220418|CWE-522: Insufficiently Protected Credentials|2400|HTTP|-|both|medium|https://hackerone.com/reports/1543773",
    "CVE-2022-22576.html|7.33.0|7.82.0|OAUTH2 bearer bypass in connection reuse|CVE-2022-22576|20220427|20220318|CWE-305: Authentication Bypass by Primary Weakness|2400|CONNREUSE|-|both|medium|https://hackerone.com/reports/1526328",
    "CVE-2021-22947.html|7.20.0|7.78.0|STARTTLS protocol injection via MITM|CVE-2021-22947|20210915|20210907|CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data|1500|STARTTLS|-|both|medium|https://hackerone.com/reports/1334763",
    "CVE-2021-22946.html|7.20.0|7.78.0|Protocol downgrade required TLS bypassed|CVE-2021-22946|20210915|20210908|CWE-325: Missing Cryptographic Step|1000|STARTTLS|-|both|medium|https://hackerone.com/reports/1334111",
    "CVE-2021-22945.html|7.73.0|7.78.0|UAF and double free in MQTT sending|CVE-2021-22945|20210915|20210719|CWE-415: Double Free|1000|MQTT|DOUBLE_FREE|both|medium|https://hackerone.com/reports/1269242",
    "CVE-2021-22926.html|7.33.0|7.77.0|CURLOPT_SSLCERT mix-up with Secure Transport|CVE-2021-22926|20210721|20210615|CWE-295: Improper Certificate Validation|1000|TLS|-|both|medium|https://hackerone.com/reports/1234760",
    "CVE-2021-22925.html|7.7|7.77.0|TELNET stack contents disclosure again|CVE-2021-22925|20210721|20210611|CWE-457: Use of Uninitialized Variable|800|TELNET|UNINIT|both|medium|https://hackerone.com/reports/1223882",
    "CVE-2021-22924.html|7.10.4|7.77.0|Bad connection reuse due to flawed path name checks|CVE-2021-22924|20210721|20210611|CWE-295: Improper Certificate Validation|1200|CONNREUSE|-|both|medium|https://hackerone.com/reports/1223565",
    "CVE-2021-22923.html|7.27.0|7.77.0|Metalink download sends credentials|CVE-2021-22923|20210721|20210530|CWE-522: Insufficiently Protected Credentials|700|Metalink|-|tool|medium|https://hackerone.com/reports/1213181",
    "CVE-2021-22922.html|7.27.0|7.77.0|Wrong content via Metalink not discarded|CVE-2021-22922|20210721|20210530|CWE-20: Improper Input Validation|700|Metalink|-|tool|medium|https://hackerone.com/reports/1213175",
    "CVE-2021-22901.html|7.75.0|7.76.1|TLS session caching disaster|CVE-2021-22901|20210526|20210429|CWE-416: Use After Free|2000|TLS|USE_AFTER_FREE|both|high|https://hackerone.com/reports/1180380",
    "CVE-2021-22898.html|7.7|7.76.1|TELNET stack contents disclosure|CVE-2021-22898|20210526|20210427|CWE-457: Use of Uninitialized Variable|1000|TELNET|UNINIT|both|medium|https://hackerone.com/reports/1176461",
    "CVE-2021-22897.html|7.61.0|7.76.1|Schannel cipher selection surprise|CVE-2021-22897|20210526|20210423|CWE-488: Exposure of Data Element to Wrong Session|800|TLS|-|both|low|https://hackerone.com/reports/1172857",
    "CVE-2021-22890.html|7.63.0|7.75.0|TLS 1.3 session ticket proxy host mix-up|CVE-2021-22890|20210331|20210317|CWE-290: Authentication Bypass by Spoofing|0|TLS|-|both|low|https://hackerone.com/reports/1129529",
    "CVE-2021-22876.html|7.1.1|7.75.0|Automatic referer leaks credentials|CVE-2021-22876|20210331|20210212|CWE-359: Exposure of Private Personal Information to an Unauthorized Actor|800|HTTP|-|both|low|https://hackerone.com/reports/1101882",
    "CVE-2020-8286.html|7.41.0|7.73.0|Inferior OCSP verification|CVE-2020-8286|20201209|20201202|CWE-299: Improper Check for Certificate Revocation|900|TLS|-|both|medium|https://hackerone.com/reports/1048457",
    "CVE-2020-8285.html|7.21.0|7.73.0|FTP wildcard stack overflow|CVE-2020-8285|20201209|20201127|CWE-674: Uncontrolled Recursion|0|FTP|-|lib|medium|https://hackerone.com/reports/1045844",
    "CVE-2020-8284.html|4.0|7.73.0|trusting FTP PASV responses|CVE-2020-8284|20201209|20201121|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|700|FTP|-|both|low|https://hackerone.com/reports/1040166",
    "CVE-2020-8231.html|7.29.0|7.71.1|wrong connect-only connection|CVE-2020-8231|20200819|20200731|CWE-825: Expired Pointer Dereference|500|internal|-|lib|low|https://hackerone.com/reports/948876",
    "CVE-2020-8177.html|7.20.0|7.70.0|curl overwrite local file with -J|CVE-2020-8177|20200624|20200530|CWE-641: Improper Restriction of Names for Files and Other Resources|700|tool|-|tool|medium|https://hackerone.com/reports/887462",
    "CVE-2020-8169.html|7.62.0|7.70.0|Partial password leak over DNS on HTTP redirect|CVE-2020-8169|20200624|20200515|CWE-200: Exposure of Sensitive Information to an Unauthorized Actor|400|HTTP|-|both|medium|https://hackerone.com/reports/874778",
    # CVE-2019-15601 is no longer considered a security problem so it should not
    # be listed here: https://daniel.haxx.se/blog/2020/03/16/warning-curl-users-on-windows-using-file/
    "CVE-2019-5481.html|7.52.0|7.65.3|FTP-KRB double free|CVE-2019-5481|20190911|20190903|CWE-415: Double Free|200|FTP|DOUBLE_FREE|both|medium|https://hackerone.com/reports/686823",
    "CVE-2019-5482.html|7.19.4|7.65.3|TFTP small blocksize heap buffer overflow|CVE-2019-5482|20190911|20190829|CWE-122: Heap-based Buffer Overflow|250|TFTP|OVERFLOW|lib|medium|https://hackerone.com/reports/684603",
    "CVE-2019-5443.html|7.44.0|7.65.1|Windows OpenSSL engine code injection|CVE-2019-5443|20190624|20190612|CWE-94: Improper Control of Generation of Code ('Code Injection')|200|TLS|-|both|high|https://hackerone.com/reports/608577",
    "CVE-2019-5436.html|7.19.4|7.64.1|TFTP receive buffer overflow|CVE-2019-5436|20190522|20190429|CWE-122: Heap-based Buffer Overflow|200|TFTP|OVERFLOW|both|low|https://hackerone.com/reports/550696",
    "CVE-2019-5435.html|7.62.0|7.64.1|Integer overflows in URL parser|CVE-2019-5435|20190522|20190424|CWE-131: Incorrect Calculation of Buffer Size|150|URL|OVERFLOW|both|low|https://hackerone.com/reports/547630",
    "CVE-2018-16890.html|7.36.0|7.63.0|NTLM type-2 out-of-bounds buffer read|CVE-2018-16890|20190206|20181230|CWE-125: Out-of-bounds Read|0|HTTP|OVERREAD|both|medium",
    "CVE-2019-3822.html|7.36.0|7.63.0|NTLMv2 type-3 header stack buffer overflow|CVE-2019-3822|20190206|20181230|CWE-121: Stack-based Buffer Overflow|0|HTTP|OVERFLOW|both|high",
    "CVE-2019-3823.html|7.34.0|7.63.0|SMTP end-of-response out-of-bounds read|CVE-2019-3823|20190206|20190118|CWE-125: Out-of-bounds Read|0|SMTP|OVERREAD|both|low",
    "CVE-2018-16842.html|7.14.1|7.61.1|warning message out-of-buffer read|CVE-2018-16842|20181031|20181027|CWE-125: Out-of-bounds Read|100|tool|OVERREAD|tool|low",
    "CVE-2018-16840.html|7.59.0|7.61.1|use after free in handle close|CVE-2018-16840|20181031|20181014|CWE-416: Use After Free|100|internal|USE_AFTER_FREE|both|low",
    "CVE-2018-16839.html|7.33.0|7.61.1|SASL password overflow via integer overflow|CVE-2018-16839|20181031|20180906|CWE-131: Incorrect Calculation of Buffer Size|0|mail|USE_AFTER_FREE|both|low",
    "CVE-2018-14618.html|7.15.4|7.61.0|NTLM password overflow via integer overflow|CVE-2018-14618|20180905|20180718|CWE-131: Incorrect Calculation of Buffer Size|0|HTTP|OVERFLOW|both|high",
    "CVE-2018-0500.html|7.54.1|7.60.0|SMTP send heap buffer overflow|CVE-2018-0500|20180711|20180611|CWE-122: Heap-based Buffer Overflow|0|SMTP|OVERFLOW|both|high",
    "CVE-2018-1000300.html|7.54.1|7.59.0|FTP shutdown response buffer overflow|CVE-2018-1000300|20180516|20180322|CWE-122: Heap-based Buffer Overflow|0|FTP|OVERFLOW|both|high",
    "CVE-2018-1000301.html|7.20.0|7.59.0|RTSP bad headers buffer over-read|CVE-2018-1000301|20180516|20180324|CWE-126: Buffer Over-read|0|RTSP|OVERREAD|both|medium",
    "CVE-2018-1000122.html|7.20.0|7.58.0|RTSP RTP buffer over-read|CVE-2018-1000122|20180314|20180220|CWE-126: Buffer Over-read|0|RTSP|OVERREAD|both|medium",
    "CVE-2018-1000121.html|7.21.0|7.58.0|LDAP NULL pointer dereference|CVE-2018-1000121|20180314|20180306|CWE-476: NULL Pointer Dereference|0|LDAP|NULL_MISTAKE|both|low",
    "CVE-2018-1000120.html|7.12.3|7.58.0|FTP path trickery leads to NIL byte out of bounds write|CVE-2018-1000120|20180314|20180129|CWE-122: Heap-based Buffer Overflow|0|FTP|OVERFLOW|both|high",
    "CVE-2018-1000007.html|6.0|7.57.0|HTTP authentication leak in redirects|CVE-2018-1000007|20180124|20180118|CWE-522: Insufficiently Protected Credentials|0|HTTP|-|both|low",
    "CVE-2018-1000005.html|7.49.0|7.57.0|HTTP/2 trailer out-of-bounds read|CVE-2018-1000005|20180124|20180110|CWE-126: Buffer Over-read|0|HTTP|OVERREAD|both|low",
    "CVE-2017-8818.html|7.56.0|7.56.1|SSL out of buffer access|CVE-2017-8818|20171129|20171118|CWE-125: Out-of-bounds Read|0|TLS|OVERREAD|both|high",
    "CVE-2017-8817.html|7.21.0|7.56.1|FTP wildcard out of bounds read|CVE-2017-8817|20171129|20171110|CWE-126: Buffer Over-read|0|FTP|OVERREAD|lib|medium",
    "CVE-2017-8816.html|7.36.0|7.56.1|NTLM buffer overflow via integer overflow|CVE-2017-8816|20171129|20171106|CWE-131: Incorrect Calculation of Buffer Size|0|HTTP|OVERFLOW|both|medium",
    "CVE-2017-1000257.html|7.20.0|7.56.0|IMAP FETCH response out of bounds read|CVE-2017-1000257|20171023|20171006|CWE-126: Buffer Over-read|0|IMAP|OVERREAD|both|medium",
    "CVE-2017-1000254.html|7.7|7.55.1|FTP PWD response parser out of bounds read|CVE-2017-1000254|20171004|20170924|CWE-126: Buffer Over-read|0|FTP|OVERREAD|both|medium",
    "CVE-2017-1000101.html|7.34.0|7.54.1|URL globbing out of bounds read|CVE-2017-1000101|20170809|20170614|CWE-126: Buffer Over-read|0|tool|OVERREAD|tool|medium",
    "CVE-2017-1000100.html|7.15.0|7.54.1|TFTP sends more than buffer size|CVE-2017-1000100|20170809|20170711|CWE-126: Buffer Over-read|0|TFTP|OVERREAD|both|high",
    "CVE-2017-1000099.html|7.54.1|7.54.1|FILE buffer read out of bounds|CVE-2017-1000099|20170809|20170715|CWE-170: Improper Null Termination|0|FILE|OVERREAD|both|medium",
    "CVE-2017-9502.html|7.53.0|7.54.0|URL file scheme drive letter buffer overflow|CVE-2017-9502|20170614|20170604|CWE-122: Heap-based Buffer Overflow|0|URL|OVERFLOW|both|high",
    "CVE-2017-7468.html|7.52.0|7.53.1|TLS session resumption client cert bypass (again)|CVE-2017-7468|20170419|20170321|CWE-305: Authentication Bypass by Primary Weakness|0|TLS|-|both|high",
    "CVE-2017-7407.html|6.5|7.53.1|--write-out out of buffer read|CVE-2017-7407|20170403|20170310|CWE-126: Buffer Over-read|0|tool|OVERREAD|tool|medium",
    "CVE-2017-2629.html|7.52.0|7.52.1|SSL_VERIFYSTATUS ignored|CVE-2017-2629|20170222|20170112|CWE-304: Missing Critical Step in Authentication|0|TLS|-|both|medium",
    "CVE-2016-9594.html|7.52.0|7.52.0|uninitialized random|CVE-2016-9594|20161223|20161221|CWE-330: Use of Insufficiently Random Values|0|internal|-|both|high",
    "CVE-2016-9586.html|5.4|7.51.0|printf floating point buffer overflow|CVE-2016-9586|20161221|20161108|CWE-121: Stack-based Buffer Overflow|0|internal|OVERFLOW|lib|medium",
    "CVE-2016-9952.html|7.27.0|7.51.0|Win CE Schannel cert wildcard matches too much|CVE-2016-9952|20161221|20161129|CWE-295: Improper Certificate Validation|0|TLS|-|both|medium",
    "CVE-2016-9953.html|7.27.0|7.51.0|Win CE Schannel cert name out of buffer read|CVE-2016-9953|20161221|20161129|CWE-126: Buffer Over-read|0|TLS|OVERREAD|both|medium",
    "CVE-2016-8615.html|4.9|7.50.3|cookie injection for other servers|CVE-2016-8615|20161102|20160923|CWE-187: Partial Comparison|0|HTTP|-|both|high",
    "CVE-2016-8616.html|7.7|7.50.3|case insensitive password comparison|CVE-2016-8616|20161102|20160923|CWE-178: Improper Handling of Case Sensitivity|0|internal|-|both|medium",
    "CVE-2016-8617.html|7.8.1|7.50.3|OOB write via unchecked multiplication|CVE-2016-8617|20161102|20160923|CWE-131: Incorrect Calculation of Buffer Size|0|internal|OVERFLOW|both|medium",
    "CVE-2016-8618.html|5.4|7.50.3|double free in curl_maprintf|CVE-2016-8618|20161102|20160923|CWE-415: Double Free|0|internal|DOUBLE_FREE|lib|medium",
    "CVE-2016-8619.html|7.3|7.50.3|double free in krb5 code|CVE-2016-8619|20161102|20160923|CWE-415: Double Free|0|FTP|DOUBLE_FREE|both|high",
    "CVE-2016-8620.html|7.34.0|7.50.3|glob parser write/read out of bounds|CVE-2016-8620|20161102|20161002|CWE-122: Heap-based Buffer Overflow|0|tool|OVERREAD|tool|medium",
    "CVE-2016-8621.html|7.12.2|7.50.3|curl_getdate read out of bounds|CVE-2016-8621|20161102|20161003|CWE-126: Buffer Over-read|0|internal|OVERREAD|both|medium",
    "CVE-2016-8622.html|7.24.0|7.50.3|URL unescape heap overflow via integer truncation|CVE-2016-8622|20161102|20160923|CWE-122: Heap-based Buffer Overflow|0|internal|OVERFLOW|both|medium",
    "CVE-2016-8623.html|7.10.7|7.50.3|Use after free via shared cookies|CVE-2016-8623|20161102|20160923|CWE-416: Use After Free|0|HTTP|USE_AFTER_FREE|lib|high",
    "CVE-2016-8624.html|6.0|7.50.3|invalid URL parsing with '#'|CVE-2016-8624|20161102|20161010|CWE-172: Encoding Error|0|URL|-|both|medium",
    "CVE-2016-8625.html|7.12.0|7.50.3|IDNA 2003 makes curl use wrong host|CVE-2016-8625|20161102|20161011|CWE-838: Inappropriate Encoding for Output Context|0|URL|-|both|high",
    "CVE-2016-7167.html|7.11.1|7.50.2|curl escape and unescape integer overflows|CVE-2016-7167|20160914|20160908|CWE-131: Incorrect Calculation of Buffer Size|0|internal|OVERFLOW|lib|medium",
    "CVE-2016-7141.html|7.19.6|7.50.1|Incorrect reuse of client certificates|CVE-2016-7141|20160907|20160822|CWE-305: Authentication Bypass by Primary Weakness|0|TLS|-|both|high",
    "CVE-2016-5419.html|5.0|7.50.0|TLS session resumption client cert bypass|CVE-2016-5419|20160803|20160415|CWE-305: Authentication Bypass by Primary Weakness|0|TLS|-|both|high",
    "CVE-2016-5420.html|7.7|7.50.0|Reusing connections with wrong client cert|CVE-2016-5420|20160803|20160615|CWE-305: Authentication Bypass by Primary Weakness|0|TLS|-|both|medium",
    "CVE-2016-5421.html|7.32.0|7.50.0|use of connection struct after free|CVE-2016-5421|20160803|20160703|CWE-416: Use After Free|0|internal|USE_AFTER_FREE|lib|high",
    "CVE-2016-4802.html|7.11.1|7.49.0|Windows DLL hijacking|CVE-2016-4802|20160530|20160507|CWE-94: Improper Control of Generation of Code ('Code Injection')|0|build|-|both|high",
    "CVE-2016-3739.html|7.21.0|7.48.0|TLS certificate check bypass with mbedTLS/PolarSSL|CVE-2016-3739|20160518|20160421|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|both|high",
    "CVE-2016-0754.html|4.0|7.46.0|remote filename path traversal in curl tool for Windows|CVE-2016-0754|20160127|20151130|CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')|0|tool|-|tool|high",
    "CVE-2016-0755.html|7.10.7|7.46.0|NTLM credentials not-checked for proxy connection reuse|CVE-2016-0755|20160127|20160113|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|medium",
    "CVE-2015-3237.html|7.40.0|7.42.1|SMB send off unrelated memory contents|CVE-2015-3237|20150617|20150522|CWE-126: Buffer Over-read|0|SMB|OVERREAD|both|high",
    "CVE-2015-3236.html|7.40.0|7.42.1|lingering HTTP credentials in connection reuse|CVE-2015-3236|20150617|20150519|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|high",
    "CVE-2015-3153.html|4.0|7.42.0|sensitive HTTP server headers also sent to proxies|CVE-2015-3153|20150429|20150312|CWE-201: Information Exposure Through Sent Data|0|HTTP|-|both|high",
    "CVE-2015-3144.html|7.37.0|7.41.0|hostname out of boundary memory access|CVE-2015-3144|20150422|20150416|CWE-124: Buffer Underwrite ('Buffer Underflow')|0|internal|OVERREAD|both|medium",
    "CVE-2015-3145.html|7.31.0|7.41.0|cookie parser out of boundary memory access|CVE-2015-3145|20150422|20150416|CWE-124: Buffer Underwrite ('Buffer Underflow')|0|HTTP|OVERREAD|both|medium",
    "CVE-2015-3148.html|7.10.6|7.41.0|Negotiate not treated as connection-oriented|CVE-2015-3148|20150422|20150331|CWE-305: Authentication Bypass by Primary Weakness|0|HTTP|-|both|medium",
    "CVE-2015-3143.html|7.10.6|7.41.0|Reusing authenticated connection when unauthenticated|CVE-2015-3143|20150422|20150224|CWE-305: Authentication Bypass by Primary Weakness|0|internal|-|both|medium",
    "CVE-2014-8151.html|7.31.0|7.39.0|Secure Transport certificate check bypass|CVE-2014-8151|20150108|20141126|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|both|medium",
    "CVE-2014-8150.html|6.0|7.39.0|URL request injection|CVE-2014-8150|20150108|20141225|CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')|0|URL|-|both|high",
    "CVE-2014-3707.html|7.17.1|7.38.0|duphandle read out of bounds|CVE-2014-3707|20141105|20140916|CWE-126: Buffer Over-read|0|internal|OVERREAD|lib|medium",
    "CVE-2014-3620.html|7.31.0|7.37.1|cookie leak for TLDs|CVE-2014-3620|20140910|20140815|CWE-201: Information Exposure Through Sent Data|0|HTTP|-|both|high",
    "CVE-2014-3613.html|4.0|7.37.1|cookie leak with IP address as domain|CVE-2014-3613|20140910|20140815|CWE-201: Information Exposure Through Sent Data|0|HTTP|-|both|medium",
    "CVE-2014-2522.html|7.27.0|7.35.0|not verifying certs for TLS to IP address / Schannel|CVE-2014-2522|20140326|20140227|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|both|medium",
    "CVE-2014-1263.html|7.27.0|7.35.0|not verifying certs for TLS to IP address / Secure Transport|CVE-2014-1263|20140326|20140227|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|both|medium",
    "CVE-2014-0139.html|7.10.3|7.35.0|IP address wildcard certificate validation|CVE-2014-0139|20140326|20140222|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|both|medium",
    "CVE-2014-0138.html|7.10.6|7.35.0|wrong reuse of connections|CVE-2014-0138|20140326|20140215|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|medium",
    "CVE-2014-0015.html|7.10.6|7.34.0|reuse of wrong HTTP NTLM connection|CVE-2014-0015|20140129|20140107|CWE-305: Authentication Bypass by Primary Weakness|0|CONNREUSE|-|both|medium",
    "CVE-2013-6422.html|7.21.4|7.33.0|cert name check ignore with GnuTLS|CVE-2013-6422|20131217|20131129|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|lib|medium",
    "CVE-2013-4545.html|7.18.0|7.32.0|cert name check ignore OpenSSL|CVE-2013-4545|20131115|20131106|CWE-297: Improper Validation of Certificate with Host Mismatch|0|TLS|-|lib|medium",
    "CVE-2013-2174.html|7.7|7.30.0|URL decode buffer boundary flaw|CVE-2013-2174|20130622|20130519|CWE-126: Buffer Over-read|0|URL|OVERREAD|lib|high",
    "CVE-2013-1944.html|4.7|7.29.0|cookie domain tailmatch|CVE-2013-1944|20130412|20130409|CWE-201: Information Exposure Through Sent Data|0|HTTP|-|both|high",
    "CVE-2013-0249.html|7.26.0|7.28.1|SASL buffer overflow|CVE-2013-0249|20130206|20130130|CWE-121: Stack-based Buffer Overflow|0|mail|OVERFLOW|both|critical",
    "CVE-2011-3389.html|7.10.6|7.23.1|SSL CBC IV vulnerability|CVE-2011-3389|20120124|20120119|CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel|0|TLS|-|both|high",
    "CVE-2012-0036.html|7.20.0|7.23.1|URL sanitization vulnerability|CVE-2012-0036|20120124|20111222|CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')|0|URL|-|both|high",
    "CVE-2011-2192.html|7.10.6|7.21.6|inappropriate GSSAPI delegation|CVE-2011-2192|20110623|20110606|CWE-281: Improper Preservation of Permissions|0|auth|-|both|medium",
    "CVE-2010-3842.html|7.20.0|7.21.1|local file overwrite|CVE-2010-3842|20101013|20100903|CWE-30: Path Traversal|0|tool|-|tool|high",
    "CVE-2010-0734.html|7.10.5|7.19.7|data callback excessive length|CVE-2010-0734|20100209|20100109|CWE-628: Function Call with Incorrectly Specified Arguments|0|internal|-|lib|high",
    "CVE-2009-2417.html|7.4|7.19.5|embedded zero in cert name|CVE-2009-2417|20090812|20090730|CWE-170: Improper Null Termination|0|TLS|NULL_MISTAKE|both|high",
    "CVE-2009-0037.html|5.11|7.19.3|Arbitrary File Access|CVE-2009-0037|20090303|20090206|CWE-142: Improper Neutralization of Value Delimiters|0|HTTP|-|both|medium",
    "CVE-2007-3564.html|7.14.0|7.16.3|GnuTLS insufficient cert verification|CVE-2007-3564|20070710|20070627|CWE-298: Improper Validation of Certificate Expiration|0|TLS|-|both|low",
    "CVE-2006-1061.html|7.15.0|7.15.2|TFTP Packet Buffer Overflow|CVE-2006-1061|20060320|20060310|CWE-122: Heap-based Buffer Overflow|0|TFTP|OVERFLOW|both|high",
    "CVE-2005-4077.html|7.11.2|7.15.0|URL Buffer Overflow|CVE-2005-4077|20051207|20051129|CWE-122: Heap-based Buffer Overflow|0|URL|OVERFLOW|both|high",
    "CVE-2005-3185.html|7.10.6|7.14.1|NTLM Buffer Overflow|CVE-2005-3185|20051013|20051012|CWE-121: Stack-based Buffer Overflow|0|HTTP|OVERFLOW|both|high",
    "CVE-2005-0490.html|7.3|7.13.0|Authentication Buffer Overflows|CVE-2005-0490|20050221|20050221|CWE-121: Stack-based Buffer Overflow|0|auth|OVERFLOW|both|high",
    "CVE-2003-1605.html|4.5|7.10.6|Proxy Authentication Header Information Leakage|CVE-2003-1605|20030803|20030803|CWE-201: Information Exposure Through Sent Data|0|HTTP|-|both|high",
    "CVE-2000-0973.html|6.0|7.4|FTP Server Response Buffer Overflow|CVE-2000-0973|20001013||CWE-121: Stack-based Buffer Overflow|0|FTP|OVERFLOW|both|critical",
    );