CVE-2026-51947

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-51957.3A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User RegisCVE-2026-519537.4An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handlCVE-2026-51954An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL witCVE-2026-519568.1A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can reCVE-2026-51966.3A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.phCVE-2026-51976.3A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_usCVE-2026-519748.8An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remoCVE-2026-519779.1An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privilegeCVE-2026-51987.3A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admiCVE-2026-51992.3A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the CVE-2026-519909.8An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helCVE-2026-519949.1mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from