2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 29 of 41

• CVE-2026-45289MEDIUM 5.3

  CloudburstMC Protocol, a library used in Minecraft Bedrock Edition servers, contained incomplete validation logic for a specific type of authentication token. This gap allowed attackers to potentially forge or manipulate authentication credentials without proper verification, compromising the integrity of server access control. The vulnerability affects publicly exposed servers running vulnerable versions of the library prior to the patched release.

• CVE-2026-45292MEDIUM 5.3

  OpenTelemetry Java is a popular library used by applications to record performance and diagnostic data. This vulnerability affects how it processes baggage—metadata that flows across service calls in distributed systems. An attacker can send oversized baggage that causes affected services to consume excessive memory and CPU, leading to denial of service. Because baggage is automatically forwarded to downstream services, the impact spreads beyond the initial target, potentially degrading performance across your entire microservices architecture.

• CVE-2026-45294MEDIUM 5.3

  FreeScout, a Laravel-based open-source help desk platform, leaks information about whether an email address is registered as a helpdesk agent account. An attacker can repeatedly submit email addresses to the password reset feature and observe different visual responses that reveal which accounts exist—a technique called user enumeration. This flaw affects all versions before 1.8.219 and requires no authentication or user interaction to exploit.

• CVE-2026-45352MEDIUM 5.3

  cpp-httplib, a popular C++ HTTP library, contains a flaw in how it processes chunked HTTP transfers. When a malicious client sends a specially crafted HTTP request with a negative chunk size (like '-2'), the library's parsing logic mishandles it. Instead of rejecting the invalid value, it converts it to an extremely large number due to how C's strtoul function treats negative numbers. This causes the server to attempt allocating massive amounts of memory and reading far more data than expected, ultimately crashing the process. Applications using cpp-httplib versions before 0.43.4 are vulnerable.

• CVE-2026-45358MEDIUM 5.3

  ImageMagick, widely used image processing software, contains an off-by-one error in its meta encoder that allows reading a single byte of memory beyond intended bounds. An unauthenticated attacker can trigger this vulnerability over the network without user interaction, potentially exposing sensitive information from the application's memory. The vulnerability affects ImageMagick versions prior to 6.9.13-47 (legacy branch) and 7.1.2-22 (current branch).

• CVE-2026-45409MEDIUM 5.3

  The Python IDNA library, which handles internationalized domain names, has a resource-exhaustion vulnerability that allows attackers to cause denial-of-service by sending specially crafted, extremely long domain names to the idna.encode() function. The vulnerability stems from the library processing certain Unicode patterns through validation logic before rejecting them as too long—a process that can consume significant CPU and memory for large inputs. This is a regression: the same issue was supposedly patched in 2024 (CVE-2024-3651), but the fix was incomplete and only addressed some code paths. Version 3.15 extends the complete fix to all relevant functions. Under normal circumstances, domain names are limited to 253 characters, so legitimate applications are unaffected. The risk exists primarily when applications pass unvalidated, arbitrarily large input directly to the library.

• CVE-2026-45410MEDIUM 5.3

  TREK, a collaborative travel planning application, contains a user enumeration vulnerability in its login process that allows attackers to determine whether specific email addresses have accounts in the system. The flaw stems from a timing discrepancy: when a user submits a login attempt with a valid email address, the backend takes approximately 370 milliseconds to complete its password check before denying access. For non-existent accounts, the system responds in roughly 10 milliseconds. This 14-fold difference in response time leaks account existence information without any change in HTTP status codes or error messages, making it detectable through simple response timing analysis. The issue has been resolved in version 3.0.18.

• CVE-2026-45543MEDIUM 5.3

  A flaw in Nextcloud Forms allows collaborators who have been removed from a form to retain unauthorized read access to uploaded respondent files. This affects forms running Nextcloud versions 4.3.0 through 5.2.6. If a user previously had access to view form results, removing them as a collaborator does not fully revoke their ability to read uploaded files associated with that form. The vulnerability is limited to files uploaded within forms where the removed user previously held results-viewing permissions.

• CVE-2026-45554MEDIUM 5.3

  NiceGUI, a Python UI framework built on FastAPI, contains a vulnerability in how it handles requests for static assets. Two specific routes can be manipulated to point to directories instead of files. When this happens, the framework throws an error that gets logged with full technical details—and these routes don't require authentication. An attacker can repeatedly trigger these errors to flood the server logs, potentially filling up disk space or overwhelming logging infrastructure. This affects NiceGUI versions before 3.12.0 and has been fixed in version 3.12.0 and later.

• CVE-2026-45620MEDIUM 5.3

  CVE-2026-45620 is a user enumeration vulnerability in WWBN AVideo version 29.0 and earlier. The `objects/mention.json.php` endpoint lacks proper authentication controls and allows attackers to discover valid usernames on the platform without logging in. An attacker can craft requests to the endpoint and enumerate users by checking responses, potentially gathering intelligence for follow-up attacks like credential stuffing or targeted social engineering.

• CVE-2026-45655MEDIUM 5.3

  Windows BitLocker, Microsoft's full-disk encryption feature, contains a flaw that allows an attacker with physical access to a device to bypass its protection and access encrypted data. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server. While an attacker must have hands-on access to the machine, the risk is significant because BitLocker is often the last defense against data theft when a device is lost, stolen, or accessed by an insider. This is not a remote attack; it requires physical presence.

• CVE-2026-45664MEDIUM 5.3

  ImageMagick, a widely-used tool for image processing and manipulation, has a vulnerability in its MNG (Multiple-Image Network Graphics) file handler that allows an attacker to bypass resource limits. By crafting a malicious MNG file with more images than the system's policy allows, an attacker can trigger excessive resource consumption—potentially causing performance degradation or denial of service. The vulnerability affects ImageMagick versions before 6.9.13-47 and 7.1.2-22, and has been resolved in those patch versions.

• CVE-2026-45780MEDIUM 5.3

  Discourse, an open-source discussion platform, has a flaw in how it handles event information that could unintentionally reveal sensitive details about private events. Specifically, the names of invited groups, sample invitee lists, and attendance statistics were being exposed to anyone who could view a topic—even if they shouldn't have access to the private event's invitee information. This is a permissions boundary issue: unauthorized users gain visibility into data they're not entitled to see. The vendor has patched this across multiple supported versions.

• CVE-2026-46337MEDIUM 5.3

  WWBN AVideo, an open-source video platform, contains a path-traversal vulnerability in version 29.0 and earlier that allows anyone on the internet to download image files from the server without logging in. An attacker can bypass the application's permission controls to access private user profile photos, admin-uploaded thumbnails, encrypted-video poster frames, and files in neighboring directories. The vulnerability exists because the affected endpoint does not validate or restrict file paths before serving images.

• CVE-2026-46344MEDIUM 5.3

  liboqs, an open-source cryptographic library implementing post-quantum algorithms, contains a flaw in its XMSS and XMSS^MT signature verification code. When verifying a signature, the code re-parses algorithm metadata from the public key and uses that metadata to determine how many bytes to read from the signature buffer. An attacker can craft a mismatched public key whose metadata claims a larger signature format than the buffer actually contains, causing an out-of-bounds read. While the read data is only used internally for hashing and cannot be stolen, it can crash the verification process if it reaches unmapped memory.

• CVE-2026-46349MEDIUM 5.3

  Mastodon versions before 4.5.10, 4.4.17, and 4.3.23 contain a flaw in how they validate digitally signed messages (Linked-Data Signatures) from other servers. An attacker can manipulate the structure of a valid signed message without breaking the signature, causing Mastodon to process it in unintended ways. This could allow spoofing—making a message appear to come from someone it didn't actually come from—but the immediate impact is limited to message manipulation rather than data theft or system shutdown.

• CVE-2026-46453MEDIUM 5.3

  Apache Camel's Elasticsearch REST client component has a critical configuration oversight that allows unauthenticated attackers to hijack Elasticsearch operations when the component is exposed via HTTP. The vulnerability stems from improperly named HTTP headers that bypass Camel's standard security filtering. An attacker can inject headers to read all documents, delete data, or extract sensitive information without any credentials. This affects multiple versions of Apache Camel and requires immediate patching or defensive workarounds.

• CVE-2026-46543MEDIUM 5.3

  A flaw in Nimiq's full node implementation allows any remote attacker to crash a node by sending a specially crafted network message. The vulnerability exists in how the node processes requests about blockchain data when reaching the earliest block (genesis block), causing an unhandled panic that terminates the node. This is a network-level denial-of-service that requires no authentication and can be exploited by any peer on the Nimiq network.

• CVE-2026-46544MEDIUM 5.3

  Microsoft's UFO framework for intelligent automation has a session reuse vulnerability affecting version 3.0.1-4-ge2626659. When a client completes a task, the session remains in memory with its results. An authenticated attacker who knows a past session ID can submit a new task request reusing that ID, causing the server to return stale results from the previous session to the new requester. This is not a critical vulnerability but poses a confidentiality risk—the attacker must be authenticated and must guess or know a valid session ID, limiting real-world exploitability.

• CVE-2026-46611MEDIUM 5.3

  Glances, a popular open-source system monitoring tool, contains a vulnerability in its XML-RPC server (activated with the -s flag) that fails to validate the HTTP Host header. This omission enables DNS rebinding attacks, where an attacker tricks a user's browser into connecting to the Glances server and extracting sensitive system monitoring data—CPU usage, memory, disk space, network statistics, running processes—without the user's knowledge. The attack requires user interaction (typically visiting a malicious website) but can expose comprehensive system information. The vulnerability affects all versions prior to 4.5.5 and is resolved in that release.

• CVE-2026-46698MEDIUM 5.3

  The Fediverse Embeds WordPress plugin before version 1.5.9 contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can exploit a security flaw in which a nonce (one-time token) intended to protect an AJAX action is publicly exposed on every page with a fediverse embed. Because the nonce is reusable and appears in public page source, an attacker can hijack it to force the WordPress server to fetch arbitrary URLs via the plugin's file_get_html() function, potentially allowing reconnaissance of internal systems or interaction with internal services.

• CVE-2026-46705MEDIUM 5.3

  Russh, a popular Rust-based SSH library used by developers to build SSH servers, has a flaw in how it manages authentication state. When a client sends multiple authentication requests (which is allowed by the SSH protocol), the library fails to properly reset internal tracking information when the username or service name changes. This means authentication decisions—like which login methods remain available or whether partial success has been achieved—can leak from one user's authentication attempt to another's. An attacker could exploit this to bypass intended authentication restrictions or gain unauthorized access to accounts.

• CVE-2026-46739MEDIUM 5.3

  Net::Statsd is a Perl library used to send metrics to statsd monitoring servers. Versions before 0.13 fail to validate metric names and values, allowing an attacker to inject arbitrary statsd commands by crafting malicious metric input. If an application uses Net::Statsd to process untrusted data—such as user-supplied values or data from external APIs—an attacker can inject additional metrics into the monitoring stream, potentially corrupting metrics, creating false alerts, or degrading visibility into system health.

• CVE-2026-46790MEDIUM 5.3

  Oracle WebCenter Content version 14.1.2.0.0 contains an information disclosure vulnerability that allows an unauthenticated attacker to read sensitive data over the network without requiring credentials or user interaction. The vulnerability is exposed through HTTP and rated medium severity due to its limited scope—only confidentiality is affected, with no impact to data integrity or system availability.

• CVE-2026-46830MEDIUM 5.3

  Oracle REST Data Services contains an information disclosure vulnerability in its Mongoapi component that allows an unauthenticated attacker to read sensitive data over the network without authentication. An attacker with network access can exploit this flaw via HTTPS to gain unauthorized visibility into data normally protected by REST Data Services, though they cannot modify or delete information. The vulnerability affects versions 24.2.0 through 26.1.0 and requires no special conditions—it's straightforward to trigger.

• CVE-2026-46841MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a network-accessible vulnerability that allows unauthenticated attackers to read sensitive data. An attacker on the network can reach the service over HTTPS without credentials and gain unauthorized access to a subset of the data REST Data Services manages. This is not a critical vulnerability—it does not enable system takeover, data modification, or service disruption—but it does represent a meaningful confidentiality risk for organizations relying on REST Data Services for data access control.

• CVE-2026-46842MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a vulnerability that allows an unauthenticated attacker to modify, add, or delete data accessible through the service over the network. The vulnerability requires no special conditions to exploit and can be triggered via standard HTTPS connections. While an attacker cannot read data or crash the service, they can alter stored information, which poses a direct integrity risk to applications relying on ORDS for data access.

• CVE-2026-46843MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a vulnerability that allows an attacker without credentials to trigger a partial denial of service over the network via HTTPS. The vulnerability is in the Core component and requires no special user interaction. An attacker can exploit this remotely to degrade availability of the REST Data Services instance, though data confidentiality and integrity are not at risk.

• CVE-2026-47167MEDIUM 5.3

  Vim, a widely-used command-line text editor, contains a code injection flaw in its Cucumber filetype plugin when Ruby support is enabled. The vulnerability arises from unsafe handling of step-definition patterns extracted from Ruby files in a repository's features or stories directories. When a user attempts to jump to a step definition using Vim's step-jump mapping, malicious patterns can execute arbitrary Ruby code and shell commands. This requires local access and user interaction—the attacker must first get the user to open a repository containing a crafted .rb file, then the user must trigger the vulnerable mapping. The issue is resolved in Vim version 9.2.0496.

• CVE-2026-47200MEDIUM 5.3

  Nuxt, a popular Vue.js web development framework, has a vulnerability where certain server-side page components are exposed over HTTP without proper security checks when a feature called Component Islands is enabled. This exposure allows unauthorized access to sensitive functionality that should only be available to authenticated users or through protected routes. The vulnerability affects Nuxt versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the related @nuxt/nitro-server package in the same version ranges.

• CVE-2026-47244MEDIUM 5.3

  Netty, a widely-used framework for building network applications and HTTP/2 servers, has a flaw in how it manages concurrent HTTP/2 streams. By default, Netty does not enforce a limit on the number of concurrent streams a client can open on a single connection, allowing an attacker to exhaust server resources by opening hundreds of thousands of stream objects. This vulnerability becomes especially dangerous when combined with Rapid-Reset-style attacks, where attackers can amplify their impact by rapidly opening and closing many streams.

• CVE-2026-47264MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains an information disclosure vulnerability that exposes the names of restricted tag groups to unauthorized users. When the site setting 'tags_listed_by_group' is enabled, anonymous and unprivileged users can access an endpoint that reveals tag group names—including those meant to be invisible or restricted to specific user groups. This occurs because the system failed to filter sensitive metadata based on the requesting user's actual permissions. The vulnerability affects multiple version branches and has been patched across all active release tracks.

• CVE-2026-47674MEDIUM 5.3

  Hono's IP-restriction middleware, a security component designed to enforce access control by allowing or denying traffic based on IP address rules, contains a flaw in how it compares incoming IP addresses against configured rules. The vulnerability exists because the middleware only performs partial normalization of IPv6 addresses before comparing them to stored rules. When an attacker sends a request using an alternative representation of an IPv6 address—such as compressed notation, explicit-zero forms, or IPv4-mapped hex notation—the middleware fails to recognize it as matching a rule, silently skipping the check. This allows traffic that should be blocked to pass through, or blocks traffic that should be allowed, depending on rule configuration. The flaw affects Hono versions prior to 4.12.21.

• CVE-2026-47676MEDIUM 5.3

  Hono, a JavaScript web framework, contains a path handling vulnerability in versions before 4.12.21 that affects how mounted sub-applications receive requests. When URLs contain percent-encoded characters (like %C3%A9 for é), the framework strips the mount prefix incorrectly, causing the sub-application to see a mangled path. This can lead to requests being routed to unintended endpoints or exposing sensitive information through path confusion.

• CVE-2026-47706MEDIUM 5.3

  Strawberry GraphQL versions 0.71.0 through 0.315.6 contain a denial-of-service vulnerability in the QueryDepthLimiter extension. An attacker can craft a GraphQL query with circular fragment references that causes the validation process to enter infinite recursion, crashing the server. This affects any GraphQL API built with vulnerable Strawberry versions. The issue is resolved in version 0.315.7.

• CVE-2026-47707MEDIUM 5.3

  Strawberry GraphQL, a Python library for building GraphQL APIs, contains a flaw in its MaxAliasesLimiter security extension that allows attackers to bypass protective limits on query aliases. The vulnerability exists because the extension counts static aliases correctly but fails to account for how fragment spreads multiply and amplify those aliases during execution. An attacker can craft a malicious GraphQL query using fragment spreads to force the server to resolve far more aliases than the configured limit permits, exhausting server resources and causing a denial of service. The issue affects versions 0.172.0 through 0.315.6; version 0.315.7 and later contain the fix.

• CVE-2026-47847MEDIUM 5.3

  Bitnami's MariaDB Galera container images and Helm chart ship with a hardcoded, publicly known username and password (monitor/monitor) that allows replication health checks. This credential cannot be changed during standard deployments and grants database replication privileges from any network location. An attacker who discovers a vulnerable Galera cluster can use this credential to access replication functions, potentially to monitor or interfere with database replication status.

• CVE-2026-48043MEDIUM 5.3

  Netty's HTTP/2 decompression logic has a resource leak that can exhaust memory and crash the JVM. When a remote attacker sends specially crafted HTTP/2 frames, the decompressor fails to properly release memory buffers, and repeated exploitation can lead to out-of-memory errors. This affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-48108MEDIUM 5.3

  Russh, a Rust-based SSH library, has a vulnerability in how it validates the initial identification string that clients and servers exchange during SSH connection setup. From version 0.34.0-beta.1 through 0.60.x, the library's server-side parser accepts malformed pre-banner lines that stricter SSH implementations like OpenSSH would reject immediately. An attacker can exploit this by sending invalid identification data repeatedly, causing the server to consume connection resources during the unencrypted pre-authentication phase. This is fixed in version 0.61.0.

• CVE-2026-48141MEDIUM 5.3

  A memory leak exists in National Instruments' grpc-device BeginSidebandStream function that can be exploited to exhaust server memory and cause denial of service. An authenticated attacker can trigger this leak repeatedly, eventually forcing the affected service to crash or become unresponsive. The vulnerability affects NI grpc-device version 2.17.0 and earlier.

• CVE-2026-48166MEDIUM 5.3

  Filament, a popular Laravel development framework, contains a timing-based information disclosure vulnerability in its login page. An unauthenticated attacker can exploit a measurable delay difference in login responses to determine whether a given email address is registered in the system. The flaw affects versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4. While the exposure is limited to account enumeration—confirming email existence without gaining unauthorized access—this reconnaissance capability can support targeted phishing, account takeover attempts, or social engineering campaigns. The vulnerability has been patched in versions 4.11.5 and 5.6.5.

• CVE-2026-48206MEDIUM 5.3

  Apache Camel's JIRA integration allows unauthenticated attackers to manipulate JIRA operations by injecting HTTP headers. When a Camel route bridges incoming HTTP requests to a JIRA producer, attackers can inject headers that override the route's intended parameters—such as which issue to modify, which project to target, or what transition to apply—using the service account credentials configured in the endpoint. The vulnerability stems from Camel's header filtering logic, which was designed to block internal Camel-namespaced headers but inadvertently allowed plain header names (like 'IssueKey' and 'ProjectKey') to pass through from HTTP clients. This means an attacker can perform JIRA operations—deleting issues, changing their status, creating issues in unintended projects, modifying fields, managing watchers, or logging time—limited only by what the service account is permitted to do.

• CVE-2026-48525MEDIUM 5.3

  PyJWT, a widely-used Python library for JSON Web Token (JWT) handling, contains a denial-of-service vulnerability in its handling of detached JWS (JSON Web Signature) tokens. When processing tokens with the unencoded-payload option enabled (RFC 7797's b64=false mode), the library decodes the Base64URL-encoded payload segment before applying detached-payload verification rules. An attacker can exploit this by sending a specially crafted token with an extremely large payload segment, forcing the library to perform unnecessary decoding and memory allocation even before signature validation occurs. This creates a resource exhaustion attack that can be triggered by unauthenticated remote clients against any application using PyJWT to verify detached JWS tokens.

• CVE-2026-48817MEDIUM 5.3

  Starlette versions 1.0.1 and earlier have a flaw in how they route HTTP requests to handler methods. When an endpoint class is set up without explicitly listing allowed HTTP methods, the framework will accept any HTTP verb and attempt to call it as a method on the endpoint object. An attacker can exploit this by sending requests with crafted HTTP methods that match internal helper methods on the endpoint, bypassing authorization checks that would normally protect those methods. FastAPI applications built on vulnerable Starlette versions are also affected. This issue is fixed in Starlette 1.1.0.

• CVE-2026-48840MEDIUM 5.3

  Exim versions 4.88 through 4.99.3 contain a memory disclosure vulnerability when deployed in certain proxy configurations. The flaw allows unauthenticated remote attackers to craft short payloads that cause the mail server to leak uninitialized stack memory back to the client. This is a confidentiality issue—an attacker gains access to sensitive data that may be in memory, but cannot modify email systems or cause service disruption directly.

• CVE-2026-48859MEDIUM 5.3

  A timing side-channel vulnerability in Erlang/OTP's SSH implementation allows attackers to discover valid usernames on an SSH server without authentication. When certain password authentication methods are enabled, the SSH daemon takes noticeably longer (~300ms) to reject logins for real usernames than for fake ones (~0ms). An attacker can exploit this timing difference to enumerate valid user accounts by measuring response times across many login attempts. The vulnerability only affects SSH servers using the legacy user_passwords or password configuration options, which are documented as test-only features; production deployments using the recommended pwdfun alternative are unaffected.

• CVE-2026-48937MEDIUM 5.3

  Node.js HTTP/2 servers have a flaw where they continue processing incoming data even after sending a GOAWAY frame—a signal that should cleanly terminate the connection. This causes servers to accept and process requests they should have already rejected, potentially leading to resource exhaustion. Node.js 22 and 24 are affected. The vulnerability is not currently known to be exploited in the wild.

• CVE-2026-48945MEDIUM 5.3

  K2, a popular article management component for Joomla, contains a vulnerability in its gallery upload feature. When users upload ZIP or TAR archives containing images, the system extracts them to a web-accessible directory but only safely renames actual image files (GIF, JPG, JPEG, PNG, WebP). Non-image files—critically, PHP scripts—are extracted with their original names and remain executable. An attacker can upload an archive containing a PHP webshell alongside legitimate images, and then directly access the shell via HTTP to execute arbitrary code on the server.

• CVE-2026-48988MEDIUM 5.3

  markdown-it, a widely-used Markdown parser, contains a denial-of-service vulnerability in versions 14.1.1 and earlier when the typographer feature is enabled. When processing Markdown text with many quotation marks, the parser consumes excessive CPU due to inefficient string manipulation, potentially allowing an attacker to degrade service availability by submitting specially-crafted Markdown. The vulnerability is fixed in version 14.2.0. Although the typographer feature is off by default, many production applications enable it for enhanced typography, making this issue relevant to deployed systems.

• CVE-2026-48990MEDIUM 5.3

  joserfc, a Python library for handling JSON Web Signatures and Encryption, has a flaw in how it processes unencoded JWS payloads (a feature defined in RFC7797). The library correctly enforces maximum payload size limits for standard JWS formats, but bypasses those same limits when processing JWS tokens marked with b64=false, which signals unencoded payloads. An attacker can exploit this inconsistency by sending an oversized JWS token that passes validation despite exceeding configured size restrictions, potentially exhausting server memory and causing denial of service. The vulnerability affects versions 1.3.4 through 1.6.5 and is resolved in version 1.6.7.

• CVE-2026-48998MEDIUM 5.3

  A library used by PHP developers to handle HTTP messages (guzzlehttp/psr7) has a flaw in how it validates the Host header when processing HTTP requests. An attacker can craft a malicious Host header that tricks the library into misidentifying which server the request is intended for. For example, an attacker could use a Host header like `[email protected]` which the library might interpret as being meant for `evil.example` rather than `trusted.example`. This matters most if your application relies on the Host header to decide where to route requests or whether to trust them. In worst-case scenarios—particularly for API gateways, proxies, or request forwarding services—this could lead to sensitive requests or credentials being sent to an attacker's server instead of the intended destination.

• CVE-2026-49077MEDIUM 5.3

  WP eMember, a WordPress membership plugin by Tips and Tricks HQ, contains a vulnerability that exposes sensitive system information to unauthorized users. An attacker without authentication can retrieve embedded sensitive data through network access, potentially learning details about your WordPress installation and membership infrastructure that should remain private. The vulnerability affects all versions through v10.2.2.

• CVE-2026-49098MEDIUM 5.3

  Apache Camel's Kafka component contains a header-injection vulnerability that allows untrusted HTTP clients to redirect Kafka messages to unintended topics. When an HTTP consumer (like platform-http) is chained into a Kafka producer within the same Camel route, attackers can inject kafka.* headers through HTTP requests to override the configured target topic, alter timestamps, or target specific partitions. This is possible because the HTTP header filter only blocks Camel-prefixed headers, allowing kafka.* headers to pass through and reach the Kafka producer unfiltered. No authentication is required if the HTTP endpoint is publicly accessible.

• CVE-2026-49099MEDIUM 5.3

  Apache Camel's Salesforce component has a vulnerability that allows attackers to hijack database queries and operations by injecting malicious headers through HTTP requests. When a route connects an HTTP endpoint to Salesforce, an unauthenticated attacker can override the intended SOQL queries, target objects, or API calls by setting specific HTTP headers. These operations execute with full permissions of the Salesforce integration user, potentially exposing sensitive data or performing unauthorized modifications. The issue stems from Camel's HTTP header filtering not recognizing Salesforce control headers as privileged, allowing them to pass through from untrusted external sources.

• CVE-2026-49130MEDIUM 5.3

  Music Player Daemon (MPD) versions before 0.24.11 have a flaw that allows attackers to inject hidden line breaks and special characters into playlist files. By crafting a malicious XSPF playlist file (a common music playlist format), an attacker can trick MPD into including forged commands or data in its responses, potentially deceiving clients or users who rely on MPD's output. This is a network-based attack requiring no special permissions or user interaction, though the real-world impact depends on how downstream systems handle the injected content.

• CVE-2026-49214MEDIUM 5.3

  guzzlehttp/psr7 versions before 2.10.2 fail to sanitize special characters in user-supplied URLs, allowing attackers to inject additional HTTP headers into outbound requests. If your application constructs HTTP requests from untrusted URLs—such as user input, forwarded requests, or webhook destinations—an attacker can craft a malicious URL that breaks out of the host parameter and injects fake headers like `X-Injected: yes`. This becomes especially dangerous when requests are relayed through proxies or load balancers, where the malformed headers can poison caches or trigger request smuggling attacks.

• CVE-2026-49328MEDIUM 5.3

  A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Fesod's image URL handling component. When an application built on Fesod processes user-supplied image URLs, an attacker can craft malicious URLs that cause the server to make unexpected outbound requests to internal systems, private cloud metadata services, or other network-restricted resources. This allows attackers to probe or interact with infrastructure that should not be directly accessible from the internet.

• CVE-2026-49342MEDIUM 5.3

  YARD, a popular documentation generator for Ruby, contains a path traversal vulnerability that allows attackers to read HTML files outside the intended documentation directory. The flaw occurs because the application checks its static file cache before properly cleaning up request paths, enabling specially crafted URLs to escape the configured document root and access sibling files. This affects versions prior to 0.9.44 and is fixed in that release.

• CVE-2026-49365MEDIUM 5.3

  Apache Camel's Netty HTTP component has a flaw where error messages are returned to users in plain text, potentially exposing sensitive information like stack traces, credentials, and internal system details. The problem stems from a default setting (muteException=false) that differs from other Camel HTTP components. Any unauthenticated user who can reach the endpoint and trigger an error—such as sending a malformed request—receives the full Java stack trace, which can reveal internal architecture and aid attackers in planning further compromises.

• CVE-2026-49397MEDIUM 5.3

  Nezha Monitoring, a self-hosted server and website monitoring tool, has a flaw in versions 2.0.0 through 2.0.13 that allows attackers to discover private services that administrators intended to keep hidden. Specifically, services marked as private (with EnableShowInService set to false) can still be enumerated through per-server API endpoints, exposing their names and response timing information. An attacker with network access to a Nezha instance doesn't need credentials to exploit this—they can systematically query endpoints and infer which services exist and how they behave based on timing patterns. This undermines the intended privacy controls.

• CVE-2026-49472MEDIUM 5.3

  FreeSWITCH versions prior to 1.11.0 contain a flaw in their embedded XML parsing library that can cause the application to stop responding to requests. The vulnerability stems from code that was copied from an older, unpatched version of libexpat and never received the security fix that libexpat itself received. An authenticated user with local or network access could trigger this denial-of-service condition, though the attack requires specific conditions to succeed.

• CVE-2026-49843MEDIUM 5.3

  FreeSWITCH versions before 1.11.1 contain a session hijacking vulnerability in the mod_verto JSON-RPC handler. An unauthenticated attacker with knowledge of a legitimate user's session ID can forcibly disconnect that user by claiming the same session identifier, causing the legitimate connection to be dropped and any active calls to be terminated. The vulnerability stems from the application binding incoming connections to user-supplied session IDs before verifying authentication credentials.

• CVE-2026-4986MEDIUM 5.3

  The WPForms WordPress plugin fails to validate PayPal webhook authenticity, enabling attackers to forge payment notifications and alter transaction states without any credentials. This means an attacker could trick a WordPress site into believing a payment succeeded or failed when it didn't, potentially disrupting order fulfillment or revenue reconciliation.

• CVE-2026-49949MEDIUM 5.3

  CodexBar versions before 0.33.0 are vulnerable to credential interception through a flaw in how the application's shared HTTP transport handles redirects. A network-adjacent attacker can trick the application into following a redirect to a different host or downgrading from HTTPS to HTTP, causing it to leak sensitive credentials—such as browser cookies, bearer tokens, or API keys—to an attacker's server. The attack requires user interaction and works only against nearby network positions, but the confidentiality impact is high.

• CVE-2026-49955MEDIUM 5.3

  Hermes WebUI versions before 0.51.270 have a flaw that lets anyone on the internet repeatedly trigger authentication challenges without actually completing the login process. By flooding the authentication endpoint with requests, attackers can exhaust server resources—filling up disk space, consuming CPU cycles, and degrading service availability for legitimate users. No authentication is required to exploit this vulnerability.

• CVE-2026-50020MEDIUM 5.3

  Netty, a widely-used Java network framework, has a flaw in how it processes incoming HTTP requests. Before reading the first line of an HTTP request, Netty discards control characters (like NUL bytes and other non-printable characters) along with whitespace. While the HTTP specification allows servers to ignore blank lines before a request, Netty goes much further by silently accepting non-standard control bytes that RFC 9112 never intended servers to strip. In architectures where multiple components handle the same traffic—such as when requests flow through a front-end proxy to a back-end Netty service—this difference in character handling can create confusion about where one request ends and another begins, potentially allowing attackers to smuggle malicious requests or bypass security controls.

• CVE-2026-50128MEDIUM 5.3

  Mastodon, the open-source social network platform, contains a vulnerability in how it validates author attribution claims on posts. Attackers can forge or modify claims about where an article originated without being detected by Mastodon's signature verification system. This affects versions 4.3.0 through 4.5.10 (4.5.x line) and 4.4.0 through 4.4.17 (4.4.x line). The flaw lies in a JSON-LD configuration error that weakens cryptographic signing, allowing an attacker to tamper with authorship metadata on legitimately signed updates.

• CVE-2026-50226MEDIUM 5.3

  The AcerConnect OTA (Over-The-Air) application contains hard-coded encryption keys that attackers can exploit to forge authentication tokens for any device. An attacker with network access can use these fixed keys to pose as legitimate devices by spoofing IMEI numbers, granting them the ability to browse firmware catalogs and download protected binary files that should remain restricted. This is a confidentiality issue—attackers gain unauthorized read access to sensitive data, but cannot currently modify or delete it through this vector.

• CVE-2026-50233MEDIUM 5.3

  Lyrion Music Server version 9.2.0 has a flaw that allows attackers to browse any folder on the server's hard drive without authentication or permission. The vulnerability exists in a directory-listing function exposed through both a command-line service and a web interface. An attacker on the network can exploit this to discover sensitive files and system information, potentially uncovering credentials, configuration details, or other valuable data stored on the host.

• CVE-2026-50244MEDIUM 5.3

  Naxclow's device registration system has a flaw that lets anyone enumerate and count the devices in an organization's fleet without needing proper authorization. When registering a new device, the platform accepts signed requests but fails to verify that the caller actually owns the account or device they're claiming to register. Each registration call returns a counter showing how many devices are currently active in that batch, and an attacker can exploit this to map out the full scope of a target's device infrastructure.

• CVE-2026-5038MEDIUM 5.3

  multer, a popular Node.js middleware for handling file uploads, has a resource exhaustion vulnerability affecting versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1. When a multipart upload is aborted or arrives malformed, the library fails to clean up temporary partial files from disk. An unauthenticated attacker can repeatedly trigger these failed uploads to consume disk space until the server runs out, causing a denial of service. No special application code flaws are needed—the vulnerability is inherent to how multer manages stream cleanup.

• CVE-2026-50560MEDIUM 5.3

  Netty, a widely-used Java framework for building network servers and clients, has a flaw in how it handles HTTP/2 header size limits. When a client specifies a maximum header list size via the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE parameter, Netty can be forced into a state where it crashes while attempting to send response headers back to the client. An attacker can exploit this to repeatedly trigger these crashes, effectively denying service to legitimate users—similar in impact to the HTTP/2 Rapid Reset attack but using different network-level mechanics. The vulnerability affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-50589MEDIUM 5.3

  OpenStack Ironic versions 32 through 36 contain a vulnerability that allows unauthenticated attackers to crash the service by sending specially crafted JSON payloads to certain API and JSON-RPC endpoints. An attacker requires only network access to the affected service and no credentials—they can disrupt availability without gaining deeper system access. The vulnerability was patched in version 37.0.0.

• CVE-2026-50629MEDIUM 5.3

  An OAuth2 server vulnerability allows attackers to inject malicious log entries by sending specially crafted requests with unvalidated control characters in the client ID parameter. The vulnerability does not leak sensitive data or directly crash the system, but it enables log manipulation—a tactic often used to cover attack tracks or create false evidence. Apache CXF versions prior to 4.2.2 and 4.1.7 are affected.

• CVE-2026-5078MEDIUM 5.3

  Morgan, a popular Node.js HTTP request logging middleware, has a vulnerability in how it handles usernames from HTTP Basic authentication. When processing login attempts, the logging middleware extracts the username and writes it to application logs without sanitizing special control characters like line breaks. An attacker can craft a fake login attempt with hidden line-break characters embedded in the username field, causing the log entry to split across multiple lines and appearing to contain forged log records. This can deceive downstream systems that rely on logs for security monitoring or compliance auditing.

• CVE-2026-52721MEDIUM 5.3

  GStreamer's pcapparse element contains multiple out-of-bounds read vulnerabilities that can be triggered when processing malformed PCAP (packet capture) files. An attacker could craft a specially crafted PCAP file with malicious IPv4/TCP header data that, when opened by a user, causes the application to read beyond allocated buffer memory. This can result in the application crashing or potentially exposing sensitive information from adjacent memory. The attack requires local access and user interaction—the target must be tricked into opening the malicious file—which limits the scope of real-world risk.

• CVE-2026-53442MEDIUM 5.3

  Jenkins fails to encrypt sensitive credentials when they are submitted via POST requests to update job configurations. Instead of storing these secrets securely, Jenkins saves them in plain text within job config.xml files on the controller. Any user with permission to read job details or anyone with file system access to the Jenkins controller can view these unencrypted secrets, creating a path for credential theft.

• CVE-2026-53467MEDIUM 5.3

  ImageMagick, a widely-used image editing and manipulation tool, contains a vulnerability in its MNG (Multiple-image Network Graphics) decoder that can leak sensitive memory contents. When processing certain MNG files, part of the image pixel data is not properly initialized, potentially exposing unintended information from the heap memory. An attacker can craft a malicious MNG file that, when processed by a vulnerable ImageMagick instance, causes the application to return heap data as part of the image output. This affects ImageMagick versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-5348MEDIUM 5.3

  A flaw in the Academy LMS WordPress plugin allows anyone on the internet to view detailed course curriculum information without logging in or being enrolled. The vulnerability exists in the plugin's REST API for managing course topics, which was misconfigured to accept requests from unauthenticated users. An attacker can exploit this by cycling through course IDs to discover what lessons, modules, or other curriculum details exist in courses marked as private, draft, scheduled, or password-protected—information that should only be visible to enrolled students or instructors.

• CVE-2026-53550MEDIUM 5.3

  js-yaml, a widely-used Node.js YAML parser, contains a denial-of-service vulnerability in its merge-key handling logic. An attacker can craft a malicious YAML document that exploits how the library processes merge operations (<<) by repeating aliases, causing the parser to consume excessive CPU time. The impact is significant for availability: a relatively small payload—just tens of kilobytes—can freeze a Node.js process for several seconds, disrupting application responsiveness or worker threads. The vulnerability has been patched in versions 4.2.0 and 3.15.0.

• CVE-2026-53851MEDIUM 5.3

  OpenClaw versions before 2026.5.12 fail to properly enforce the disabling of Slack reaction event notifications. When reaction notifications are toggled off in the configuration, the system still processes incoming Slack reaction events within its agent pipeline. An attacker can exploit this by sending reaction events to trigger unintended agent actions, circumventing the intended notification controls and potentially causing the system to process lower-trust input that should have been filtered out.

• CVE-2026-53947MEDIUM 5.3

  Ghost, a Node.js-based content management system, contains a vulnerability in its member signin endpoints that allows an unauthenticated attacker to discover whether an email address belongs to a registered member of a Ghost site. The flaw stems from inconsistent response patterns when valid versus invalid member emails are submitted, enabling email enumeration attacks. Versions 5.18.0 through 6.21.0 are affected; the issue is resolved in version 6.21.1.

• CVE-2026-53949MEDIUM 5.3

  Ghost, a popular Node.js-based content management system, contains a flaw in how it validates filter parameters on public API endpoints. Attackers can exploit this weakness to bypass security checks and access private fields that should be hidden, potentially including user password hashes. The severity of the exposure depends on the underlying database: SQLite instances leak complete password hashes, while MySQL instances lose case sensitivity information in hashes, which significantly hampers offline brute-force feasibility. The vulnerability affects Ghost versions 5.46.1 through 6.21.2, and the issue is resolved in version 6.21.2.

• CVE-2026-54022MEDIUM 5.3

  Open WebUI, a self-hosted AI platform, contains an authorization bypass that allows authenticated users to read private notes belonging to other users. The vulnerability stems from a mismatch between how the access control layer and the storage layer handle document identifiers. While the authorization check looks for note IDs with colons (note:123), the underlying storage system normalizes all colons to underscores (note_123). An attacker who knows or guesses a target user's note ID can simply request it using the underscore format, bypassing the ownership check and receiving the full private note contents. This affects Open WebUI versions before 0.8.11 and requires the attacker to be an authenticated user of the platform.

• CVE-2026-54029MEDIUM 5.3

  LibreChat, a self-hosted ChatGPT alternative that integrates multiple AI providers, contains an authorization flaw in its message deletion endpoint. An authenticated attacker can delete any other user's messages by exploiting a gap between authentication (which checks conversation ownership) and authorization (which does not check message ownership). The attacker supplies their own valid conversation ID to bypass initial validation, then targets a victim's message ID for deletion. Messages deleted this way cannot be recovered. The vulnerability affects all versions before 0.8.4-rc1 and is resolved in that release.

• CVE-2026-54036MEDIUM 5.3

  LibreChat versions prior to 0.8.4-rc1 contain a critical flaw in two-factor authentication (2FA) management. An attacker who has compromised a user's session token can call a specific API endpoint to completely reset that user's 2FA settings—overwriting their TOTP secret, invalidating backup codes, and disabling 2FA entirely—without needing to know or verify the existing 2FA credentials. This locks legitimate users out of their own account security while giving the attacker an open door to permanent access.

• CVE-2026-54105MEDIUM 5.3

  Two U.S. government systems used for federal contract disputes—the GAO's Electronic Protest Docketing System and the CBCA's Electronic Docketing System—leak user email addresses and account details through an unprotected API endpoint. An attacker can request information about any user account without logging in, simply by guessing or iterating user ID numbers. The systems fail to validate that a requester has permission to view account data belonging to someone else.

• CVE-2026-54236MEDIUM 5.3

  vLLM, a popular open-source engine for running and serving large language models, has a vulnerability that leaks sensitive memory addresses to clients. The issue stems from an incomplete fix to a prior vulnerability: while one code path was patched to hide memory addresses from error messages, several other code paths still expose this information. An attacker can exploit this by sending specially crafted image data through vLLM's Anthropic API endpoints, triggering an error that includes a memory address in the response. This leak could help an attacker defeat memory layout randomization (ASLR), a common defense against exploitation. The vulnerability affects vLLM versions before 0.23.1rc0 and requires no authentication to exploit.

• CVE-2026-54269MEDIUM 5.3

  protobufjs is a widely-used library that converts Protocol Buffer schema definitions into JavaScript code. Versions before 8.6.0 and 7.6.3 contain a flaw where certain field or service names—particularly hasOwnProperty, $type, and rpcCall—can collide with names reserved by protobufjs's internal runtime helpers. When a schema uses these conflicting names, the library may read attacker-controlled data from the schema instead of accessing its own safety mechanisms, potentially causing the application to crash or enter infinite loops during message decoding, validation, or RPC operations.

• CVE-2026-54270MEDIUM 5.3

  protobufjs, a popular JavaScript library for working with Protocol Buffers, has a memory exhaustion vulnerability in versions 8.2.0 through 8.4.2. When decoding untrusted protobuf messages, the library automatically stores unknown fields in memory without providing a way to discard them at decode time. An attacker can craft a malicious protobuf payload with many unknown fields that forces the decoded message to consume far more memory than the payload's raw size would suggest, potentially causing denial of service through resource exhaustion. The vulnerability affects applications that decode protobuf data from untrusted sources, particularly those handling user-supplied or network-sourced messages. Version 8.5.0 introduced options to control unknown-field retention, and version 8.6.2 made discarding unknown fields the default behavior.

• CVE-2026-54285MEDIUM 5.3

  OpenTelemetry's JavaScript implementation has a memory exhaustion vulnerability in its baggage header parsing logic. When the library processes inbound HTTP headers containing baggage data, it fails to validate the size of that data. An attacker can send abnormally large or numerous baggage entries, causing the application to allocate memory without limits, potentially degrading performance or crashing the service. The vulnerability exists only in the inbound parsing path; outbound validation was already in place. Version 2.8.0 and later address this issue.

• CVE-2026-54287MEDIUM 5.3

  Hono, a JavaScript web framework supporting multiple runtimes, has a flaw in how it handles HTTP cookies when deployed on AWS Lambda with either Application Load Balancer (ALB) or VPC Lattice v2. The framework incorrectly combines multiple Set-Cookie headers into a single comma-separated value. Since commas naturally appear in cookie attributes like expiration dates, clients cannot reliably parse them back into separate cookies, leading to silent data loss or misinterpretation. This affects cookie-based security controls and session management. The issue is resolved in version 4.12.25.

• CVE-2026-54300MEDIUM 5.3

  @astrojs/netlify versions before 7.0.13 contain a logic flaw in how remote image access patterns are converted for Netlify's Image CDN. When you define trusted image sources using wildcards—like *.example.com or /images/*—the adapter translates these rules incorrectly, allowing images from unintended hosts and paths to pass validation. For example, a wildcard subdomain pattern meant to match api.example.com would inadvertently permit requests from example.com itself (the apex domain), and a path pattern intended to restrict /images/* would match any deeper path like /images/foo/bar/baz. This creates an uncontrolled image loading vulnerability where the adapter grants Image CDN access to sources beyond your intended scope.

• CVE-2026-54470MEDIUM 5.3

  Dell Unisphere for PowerMax versions 10.3.0.5 and earlier contain an XML External Entity (XXE) vulnerability that allows a low-privileged remote attacker to read sensitive data without authorization. The vulnerability is difficult to exploit in practice—it requires valid user credentials and specific conditions—but when successfully exploited, it can expose confidential information stored or processed by the storage management system.

• CVE-2026-54500MEDIUM 5.3

  Oj is a widely-used Ruby gem for parsing JSON data. A flaw in versions before 3.17.3 causes the parser to leak uninitialized memory from the process stack when it encounters JSON objects with very long keys (254 bytes or more). An attacker can craft a malicious JSON payload to trigger this memory leak, potentially exposing sensitive data that happened to be in memory at that moment. The vulnerability is reachable over the network if your application parses untrusted JSON input.

• CVE-2026-54514MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to objects, has a DNS leakage vulnerability in versions before 2.18.8, 2.21.4, and 3.1.4. When an application deserializes untrusted JSON containing an InetSocketAddress field, the library performs an immediate DNS lookup on any hostname in that field—before the application has a chance to validate the data or decide whether to connect. This allows an attacker to force your systems to issue DNS queries to attacker-controlled domains, leaking information about what JSON you're processing and potentially enabling DNS-based attacks.

• CVE-2026-54515MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to Java objects, has a flaw that allows properties marked to be ignored during deserialization to become writable again in certain configurations. When a developer uses @JsonIgnoreProperties to exclude specific fields from being deserialized, and also enables case-insensitive property matching via @JsonFormat, the library incorrectly rebuilds its property filter from the unfiltered map, reinstating the very properties it should block. An attacker who can supply JSON input to an affected application could write to fields that should be protected, potentially modifying application state or bypassing business logic constraints.

• CVE-2026-54516MEDIUM 5.3

  Jackson-databind, a widely-used Java library for converting JSON to and from objects, has a flaw in how it handles property annotations. The bug allows attackers to write data to fields that should be protected by @JsonIgnore annotations when certain conditions are met. Specifically, if a class uses @JsonProperty to rename a getter but @JsonIgnore on the setter, an attacker can bypass the ignore directive by sending JSON with the renamed key, directly modifying the underlying field. This works because Jackson's property inference logic treats the backing field as writable even though the intended API forbids it. The vulnerability affects versions 2.21.0 through 2.21.4 and 3.1.4 (or earlier in the 3.x line prior to 3.1.4).

• CVE-2026-54517MEDIUM 5.3

  A flaw in Jackson's data-binding library allows attackers to bypass view-based access controls during JSON deserialization. When a JSON API uses @JsonView annotations to hide certain properties from specific clients or roles, this vulnerability can cause hidden collection or map properties to be populated anyway if they lack a setter method. An attacker sending crafted JSON can inject data into fields that should have been invisible, potentially modifying application state in unintended ways.

• CVE-2026-5459MEDIUM 5.3

  A WordPress plugin called User Frontend has a security flaw that allows anyone on the internet—without needing to log in—to change another user's subscription status. Specifically, an attacker can downgrade a paying customer to a free subscription tier, removing their paid features. The vulnerability exists in how the plugin handles subscription activation requests and fails to verify that the person making the request has permission to modify that user's account.