CVEs 2016-54{19,20,21} came out today, all of which have patches which readily applied to existing curl versions on our supported (r151014/LTS, r151016/last-stable, r151018/this-stable) releases.
A "pkg update" will do it, and as mentioned, the curl versions are not being bumped, just patched, for these CVEs.
FYI,
Dan