CVE Watch14 de out. de 2026

CVE-2022-43551

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be

CVSS

7.5

Alta

EPSS

16.6%

p97

KEV

—

Exploit Today

0-100

Publicado: 23 de dez. de 2022 · Última mod.: 14 de out. de 2026 · CWE-319

EPSS · 30d

16.5%EPSS · 30 dias16.6%

2026-10-142026-11-11

Descrição técnica

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-181286.8 MÉD

39.1%

——12Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.2d CVE-2026-124600—

9.5%

——3GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.2d CVE-2026-1153388.1 ALT

4.8%

——1Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.21h CVE-2026-1234976.8 MÉD

5.0%

——2Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.2d CVE-2026-543733.5 BAI

1.3%

——0VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can manipulate support content displayed to the user by tampering with unencrypted HTTP traffic between the app and server.3d CVE-2026-1207346.5 MÉD

13.2%

——4Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.2d