CVE-2026-14953

MediumCVSS 4.3/10Last modified Sep 3, 2026

Description

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
Frauscher Sensortechnik	FDS 102	>= 2.11.0, <= 2.13.3

References

https://www.certvde.com/en/advisories/VDE-2026-078/

Timeline

Published: Aug 20, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-149556.5The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi CVE-2026-149569.8The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to imp CVE-2026-149577.5In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_E CVE-2026-149587.2IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell inter CVE-2026-149597.2IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command inject CVE-2026-14969.3Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable CVE-2026-149609.8Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers CVE-2026-149616.2Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly restrict access to sensitive IOCTL functio CVE-2026-149628.6The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQ CVE-2026-149634.3IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forg CVE-2026-149663.1BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symli CVE-2026-149673.1BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containme