CVE-2026-56066

MediumCVSS 5.8/10Last modified Oct 25, 2026

Description

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-560679.3Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.CVE-2026-560689.3Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.CVE-2026-560697.5Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.CVE-2026-56076.3A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of theCVE-2026-560709.3Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-560717.1Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-560727.1Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.CVE-2026-560739.4Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verificatioCVE-2026-560745.5PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command CVE-2026-560758.8PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, ovCVE-2026-560768.1PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger CVE-2026-560776.5PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access
CVE-2026-56066: Medium severity, CVSS 5.8 | Vulnix