2026 · Medium
Medium-severity vulnerabilities disclosed in 2026
Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.
4010 published vulnerabilities · page 41 of 41
- CVE-2026-28581MEDIUM 4.0
A logic error in Android's call processing code allows an application to initiate emergency calls without proper authorization checks. The vulnerability stems from inadequate validation in the CallIntentProcessor when determining the initiating user, potentially enabling an app to trigger emergency dialing functionality that should be restricted. No user interaction is required for exploitation, and the issue affects multiple Android versions.
- CVE-2026-41714MEDIUM 4.0
Spring AMQP applications that connect to RabbitMQ brokers using AMQPS URIs without explicitly enabling SSL validation are vulnerable to man-in-the-middle attacks. While the connection appears encrypted, the application skips critical TLS certificate and hostname verification steps, allowing an attacker to intercept credentials and sensitive message data. This occurs when developers configure RabbitConnectionFactoryBean with an amqps:// URI but omit the setUseSSL(true) call, creating a false sense of security.
- CVE-2026-45536MEDIUM 4.0
Netty, a widely-used Java network framework, has a file descriptor leak in its Unix domain socket implementation when handling multi-fd messages. When a peer sends a crafted control message carrying multiple file descriptors via SCM_RIGHTS, Netty's receiver allocates a fixed buffer that happens to fit the kernel's response exactly. The code then performs a validation check that fails due to the unexpected message format, causing the installed file descriptors to never be closed. Applications using DomainSocketChannel with FILE_DESCRIPTORS read mode—a non-default opt-in feature—can leak two file descriptors per malicious message received from a peer on the same host. This degrades availability by exhausting the process's file descriptor limit.
- CVE-2026-46559MEDIUM 4.0
ImageMagick, a widely used open-source image editing tool, contains a flaw in how it validates JP2 (JPEG 2000) image files. When processing certain malformed JP2 files, the software writes a single byte of data beyond the boundaries of an allocated memory region. While limited to overwriting one byte, this heap buffer overflow could cause the application to crash or, in specific configurations, enable an attacker to influence program behavior. The issue affects ImageMagick versions before 6.9.13-48 and 7.1.2-23.
- CVE-2026-53464MEDIUM 4.0
ImageMagick versions before 7.1.2-25 leak a small amount of memory when the wand option parser receives invalid input. An attacker with local access could trigger this repeatedly to consume system memory and degrade performance or cause denial of service. The issue is low-impact but present in all affected versions.
- CVE-2026-53945MEDIUM 4.0
Ghost, a popular Node.js-based content management system, contains a vulnerability in how it validates target addresses before making outbound HTTP requests. Between versions 6.0.9 and 6.21.0, an attacker can exploit DNS rebinding techniques to trick the Ghost server into connecting to internal network resources that should be off-limits. This bypass affects features within Ghost that fetch external content, potentially allowing unauthorized access to sensitive internal systems. The issue is resolved in version 6.21.1.
- CVE-2026-55688MEDIUM 4.0
AsyncHttpClient (AHC), a widely-used Java library for handling HTTP requests, contains a cookie injection vulnerability in versions 2.0.0–2.15.x and 3.0.0.Beta1–3.0.10. The flaw allows a malicious server to plant cookies intended for unrelated domains into the client's cookie store. When the affected application later communicates with the legitimate domain, it unwittingly sends the attacker-injected cookie. This attack succeeds only when a single AHC instance handles connections to both an attacker-controlled server and a trusted destination—a common pattern in applications that pool HTTP clients across multiple hosts.
- CVE-2026-56357MEDIUM 4.0
n8n's GitHub Webhook Trigger node accepts webhook requests without verifying their authenticity, allowing attackers to forge webhook events if they know the webhook URL. An attacker could send spoofed GitHub webhook payloads directly to a workflow, potentially triggering unintended automation actions. This is a signature verification bypass rather than a complete authentication failure, meaning the vulnerability requires knowledge of the specific webhook URL but does not require credentials or sophisticated network access.
- CVE-2026-56360MEDIUM 4.0
n8n workflow automation platform versions before 1.123.18 and 2.6.2 contain a webhook signature verification flaw in the Zendesk integration node. The vulnerability allows attackers to send unauthenticated requests to known webhook URLs, injecting arbitrary data into workflows. While the attack requires knowledge of a specific webhook endpoint URL and cannot directly compromise confidentiality or availability, it creates a path for data tampering and unauthorized workflow execution within an organization's automation infrastructure.
- CVE-2026-57053MEDIUM 4.0
GNU libidn, a widely-used library for handling internationalized domain names, contains a flaw in its ToUnicode conversion APIs that can read uninitialized memory from your system. This occurs when the library processes certain domain name conversions, potentially exposing sensitive data that happened to be in memory. The vulnerability affects libidn versions before 1.44; the newer libidn2 implementation does not have this issue. While the attack requires local access and specific conditions to trigger, the combination of memory disclosure and potential data corruption makes it a meaningful security concern for systems that process untrusted international domain names.