CVE-2026-94266

Not scored yetLast modified Oct 22, 2026

Description

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-942679.0The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-942688.1The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-942696.3Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive routCVE-2026-94278.8A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the compCVE-2026-942705.3The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and shCVE-2026-942715.3The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return fromCVE-2026-942725.3The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorisCVE-2026-942735.3The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approveCVE-2026-942745.3The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, inclCVE-2026-942755.3The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, CVE-2026-942765.1Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authoriCVE-2026-942776.3MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via spri
CVE-2026-94266: Unscored | Vulnix