CVE-2026-66476

MediumCVSS 4.9/10Last modified Oct 24, 2026

Description

Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-664775.3Unauthenticated Broken Access Control in Gillion <= 4.13 versions.CVE-2026-664789.3Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.CVE-2026-664797.1Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplCVE-2026-66483.5A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component Internal Message ModuCVE-2026-664805.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows RetCVE-2026-664816.8Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.CVE-2026-664829.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.CVE-2026-664839.8Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.CVE-2026-664844.6GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode CVE-2026-664854.6GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocatCVE-2026-664864.6GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members CVE-2026-664885.3Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVE-2026-66476: Medium severity, CVSS 4.9 | Vulnix