CVE-2026-51954

Not scored yetLast modified Oct 22, 2026

Description

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-519568.1A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can reCVE-2026-51966.3A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.phCVE-2026-51976.3A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_usCVE-2026-519748.8An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remoCVE-2026-519779.1An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privilegeCVE-2026-51987.3A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admiCVE-2026-51992.3A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the CVE-2026-519909.8An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helCVE-2026-519949.1mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from CVE-2026-519957.5An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-sCVE-2026-519969.8An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getSCVE-2026-519978.8An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions
CVE-2026-51954: Unscored | Vulnix