CVE-2026-14950

CriticalCVSS 9.8/10Last modified Sep 3, 2026

Description

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-149518.0An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web p CVE-2026-149527.5An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and add CVE-2026-149534.3A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint CVE-2026-149556.5The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi CVE-2026-149569.8The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to imp CVE-2026-149577.5In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_E CVE-2026-149587.2IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell inter CVE-2026-149597.2IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command inject CVE-2026-14969.3Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable CVE-2026-149609.8Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers CVE-2026-149616.2Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functio CVE-2026-149628.6The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQ