CVE-2026-14953
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Aug 20, 2026 · Last modified: Aug 20, 2026 · CWE-425
Not enough EPSS history yet.
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-767995.3 MED—
——0A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation causes files or directories accessible. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.8hCVE-2026-199035.3 MED23.9%
——7A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.8hCVE-2026-600115.3 MED14.3%
——4Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.17dCVE-2026-217604.6 MED4.6%
——1HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.7dCVE-2024-235733.7 LOW5.2%
——2HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.0 and TLS1.0. This can also be considered a type of man-in-the-middle attack.34dCVE-2026-119864.9 MED22.7%
——7A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.9d