curl moves LOW and MEDIUM vulnerability reports to public GitHub

From 26 October 2026, curl files every vulnerability report rated LOW or MEDIUM in its public GitHub issue tracker, while HIGH and CRITICAL reports stay private on HackerOne. The project says over 90% of submissions rate below HIGH and maintainers are at the limit of their capacity.

• From 26 October 2026, LOW and MEDIUM curl reports go to public GitHub issues
• HIGH and CRITICAL reports remain private in the HackerOne queue
• Over 90% of recent submissions were assessed below HIGH severity
• Maintainers say they are overloaded and expect no drop in volume soon