CVE-2026-66482

CriticalCVSS 9.8/10Last modified Oct 13, 2026

Description

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-664839.8Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.CVE-2026-664844.6GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode CVE-2026-664854.6GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocatCVE-2026-664864.6GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members CVE-2026-664885.3Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2CVE-2026-664895.3Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2CVE-2026-66496.3A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. ExecuCVE-2026-664906.1Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2CVE-2026-664918.2Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function leCVE-2026-664926.1Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload CVE-2026-664936.4Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy anCVE-2026-664948.7Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker
CVE-2026-66482: Critical severity, CVSS 9.8 | Vulnix