Why is curl catching so many security issues?

I can see something like nginx being in that spot but curl is primarily user initiated and pointed at a known target rather than internet facing accepting connections