2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

1806 published vulnerabilities · page 19 of 19

• CVE-2026-10998MEDIUM 4.0

  CVE-2026-10998 is a memory safety issue in Google Chrome's media handling code that allows an attacker positioned on the same local network to read data from memory locations they shouldn't have access to. The vulnerability exists in Chrome versions before 149.0.7827.53. An attacker would need to send specially crafted network traffic to trigger an out-of-bounds read, which could potentially expose sensitive information resident in the browser's memory. This is a local-network-only threat, meaning the attacker must be on your network segment to exploit it.

• CVE-2026-28581MEDIUM 4.0

  A logic error in Android's call processing code allows an application to initiate emergency calls without proper authorization checks. The vulnerability stems from inadequate validation in the CallIntentProcessor when determining the initiating user, potentially enabling an app to trigger emergency dialing functionality that should be restricted. No user interaction is required for exploitation, and the issue affects multiple Android versions.

• CVE-2026-41714MEDIUM 4.0

  Spring AMQP applications that connect to RabbitMQ brokers using AMQPS URIs without explicitly enabling SSL validation are vulnerable to man-in-the-middle attacks. While the connection appears encrypted, the application skips critical TLS certificate and hostname verification steps, allowing an attacker to intercept credentials and sensitive message data. This occurs when developers configure RabbitConnectionFactoryBean with an amqps:// URI but omit the setUseSSL(true) call, creating a false sense of security.

• CVE-2026-45536MEDIUM 4.0

  Netty, a widely-used Java network framework, has a file descriptor leak in its Unix domain socket implementation when handling multi-fd messages. When a peer sends a crafted control message carrying multiple file descriptors via SCM_RIGHTS, Netty's receiver allocates a fixed buffer that happens to fit the kernel's response exactly. The code then performs a validation check that fails due to the unexpected message format, causing the installed file descriptors to never be closed. Applications using DomainSocketChannel with FILE_DESCRIPTORS read mode—a non-default opt-in feature—can leak two file descriptors per malicious message received from a peer on the same host. This degrades availability by exhausting the process's file descriptor limit.

• CVE-2026-46559MEDIUM 4.0

  ImageMagick, a widely used open-source image editing tool, contains a flaw in how it validates JP2 (JPEG 2000) image files. When processing certain malformed JP2 files, the software writes a single byte of data beyond the boundaries of an allocated memory region. While limited to overwriting one byte, this heap buffer overflow could cause the application to crash or, in specific configurations, enable an attacker to influence program behavior. The issue affects ImageMagick versions before 6.9.13-48 and 7.1.2-23.

• CVE-2026-53464MEDIUM 4.0

  ImageMagick versions before 7.1.2-25 leak a small amount of memory when the wand option parser receives invalid input. An attacker with local access could trigger this repeatedly to consume system memory and degrade performance or cause denial of service. The issue is low-impact but present in all affected versions.