# Daniel Stenberg, "Twenty-two pending curl vulnerabilities" (7 Oct 2026): recompute, 26 Oct 2026

This supports the post. By curl's own records, curl has published three CVEs rated HIGH since 2021, the two the post names plus CVE-2026-92392. The CVSS scores CISA adds to the same CVE records put 55 of curl's CVEs at HIGH or CRITICAL, which is the gap the post's "we basically don't believe in CVSS scoring" is about.

The sentence: "We have only published two CVEs with severity HIGH since 2021, the most recent one being CVE-2023-38545."

Our path: every CVE in curl's vuln.json (curl.se/docs/vuln.json, read 26 October) published from January 2021 to 14 October 2026, 141 in all, beside the CVSS severity in the CISA ADP section of the same record from the CVE Program's API (cveawg.mitre.org). CISA scored 109 of the 141, all with CVSS 3.1.

| curl's rating | CVEs | CISA scored | CISA LOW | CISA MEDIUM | CISA HIGH | CISA CRITICAL |
|---|---|---|---|---|---|---|
| LOW | 90 | 63 | 6 | 24 | 26 | 7 |
| MEDIUM | 48 | 44 | 2 | 22 | 12 | 8 |
| HIGH | 3 | 2 | 0 | 0 | 2 | 0 |
| All | 141 | 109 | 8 | 46 | 40 | 15 |

- Where both sides call it HIGH, they agree: CVE-2023-38545 (CISA 8.8) and CVE-2026-92392 (8.1). CISA has no score on CVE-2021-22901.
- Of the 63 CVEs curl rated LOW that CISA scored, CISA put 33 at HIGH or CRITICAL. The seven LOWs it scored CRITICAL: CVE-2023-23914 (HSTS ignored on multiple requests, 9.1), CVE-2023-27533 (TELNET option IAC injection, 9.8), CVE-2026-8924 (trailing dot domain super cookie, 9.1), CVE-2026-8926 (password leak with netrc and user in URL, 9.1), CVE-2026-10536 (HTTP/2 stream-dependency tree UAF, 9.8), CVE-2026-11564 (native CA trust persist, 9.1), CVE-2026-18924 (HTTP/2 server push UAF, 9.1).
- 2026 so far: 69 CVEs, curl rated one HIGH; CISA put 30 at HIGH or CRITICAL.
- Overall, the two ratings match on 30 of the 109 CVEs CISA scored.

Not covered: NVD's own scores and any vendor's; why CISA scored some CVEs and not others.

Files: compare.py, rows.csv (each CVE with curl's rating and CISA's severity and score), summary.json, vuln.json as read.