Do minor curl vulnerabilities in the open
Summary
The curl project announced a policy change for vulnerability disclosures, requiring LOW and MEDIUM reports to be submitted as GitHub issues starting October 26, 2026, while HIGH and CRITICAL issues remain private in HackerOne. The change aims to handle an increasing volume of submissions and involve the community in assessment and remediation, with recognition of risks around public disclosure and attacker window for non-high issues.