CVE-2026-63650 | | | 2026-08-14 | OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup… |
CVE-2026-49457 | Critical | 9.1 | 2026-08-14 | erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The Cer… |
CVE-2026-54481 | High | 7.5 | 2026-08-13 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) |
CVE-2026-70454 | High | 8.0 | 2026-08-13 | rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path atta… |
CVE-2026-0296 | | | 2026-08-13 | Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) acces… |
CVE-2026-18679 | | | 2026-08-12 | When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disab… |
CVE-2026-18678 | | | 2026-08-12 | When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over… |
CVE-2026-71290 | Critical | 9.1 | 2026-08-11 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when us… |
CVE-2026-66154 | High | 8.3 | 2026-08-11 | An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions… |
CVE-2026-48437 | Medium | 5.5 | 2026-08-11 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-11814 | | | 2026-08-11 | A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffi… |
CVE-2026-18129 | High | 8.1 | 2026-08-11 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MI… |
CVE-2026-15554 | High | 7.4 | 2026-08-11 | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated… |
CVE-2026-66760 | Medium | 6.4 | 2026-08-11 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same t… |
CVE-2026-66410 | Medium | 4.8 | 2026-08-10 | Android and iOS apps ECOVACS PRO App improperly validate server certificates.
Communication may be retrieved and/or altered. |
CVE-2026-66406 | Medium | 4.8 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled.
A man-in-the-middle attack may allow to obtain and/or alter c… |
CVE-2026-66404 | Medium | 6.5 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products… |
CVE-2026-64993 | Medium | 6.8 | 2026-08-06 | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could poten… |
CVE-2026-16792 | Medium | 6.1 | 2026-08-04 | An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent… |
CVE-2026-69248 | | | 2026-08-03 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA perm… |
CVE-2026-67598 | High | 7.4 | 2026-08-03 | Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to inter… |
CVE-2025-9291 | Medium | 6.5 | 2026-08-03 | A
certification validation weakness exists in communication between affected
Omada devices and cloud controllers. Certificate identity verification does not
ad… |
CVE-2026-18089 | High | 7.5 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when n… |
CVE-2026-0392 | | | 2026-08-03 | eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protecte… |
CVE-2026-58062 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Jav… |
CVE-2026-8763 | | | 2026-08-03 | In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS befor… |
CVE-2026-67294 | Medium | 5.9 | 2026-08-01 | FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_u… |
CVE-2026-67293 | Medium | 4.2 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hos… |
CVE-2026-66402 | Critical | 9.8 | 2026-08-01 | FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hos… |
CVE-2026-18141 | High | 8.2 | 2026-07-31 | A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual… |
CVE-2026-8497 | High | 7.4 | 2026-07-29 | Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS… |
CVE-2026-18257 | Medium | 5.6 | 2026-07-29 | Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to b… |
CVE-2026-58162 | Critical | 10.0 | 2026-07-29 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.
This issue affects Apache Traffic Server: from 8.0… |
CVE-2026-65325 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname.
This issue affect… |
CVE-2026-16107 | Medium | 5.9 | 2026-07-28 | IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to o… |
CVE-2026-54342 | High | 8.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a s… |
CVE-2026-48021 | Critical | 9.1 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake wi… |
CVE-2026-52688 | High | 7.5 | 2026-07-23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation |
CVE-2026-56820 | High | 7.4 | 2026-07-21 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Fin… |
CVE-2026-60648 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-56624 | High | 7.3 | 2026-07-20 | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH.
Server-side Open… |
CVE-2026-46428 | | | 2026-07-20 | lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration si… |
CVE-2026-13410 | High | 8.2 | 2026-07-17 | Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.
The default user agent is initialised with SSL_verify_mode explicit… |
CVE-2026-38974 | Medium | 5.3 | 2026-07-15 | Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py. |
CVE-2026-13385 | | | 2026-07-15 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user… |
CVE-2026-50302 | Medium | 4.2 | 2026-07-14 | Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-55001 | High | 7.8 | 2026-07-14 | Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally. |
CVE-2026-47632 | High | 8.8 | 2026-07-14 | Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-59836 | High | 7.5 | 2026-07-14 | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all vers… |
CVE-2026-15683 | High | 7.5 | 2026-07-13 | Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attack… |
CVE-2026-22093 | | | 2026-07-13 | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker o… |
CVE-2026-54919 | High | 7.4 | 2026-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL… |
CVE-2026-0277 | Medium | 5.9 | 2026-07-09 | An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to interc… |
CVE-2026-59818 | Medium | 6.5 | 2026-07-08 | etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls… |
CVE-2026-55436 | High | 7.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.3… |
CVE-2026-6900 | High | 7.4 | 2026-07-06 | Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL.
This issue affects APROL: before R 4.4-01P5. |
CVE-2026-8286 | High | 8.1 | 2026-07-03 | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the
connection might reuse an existing live connection even though the TLS
configurat… |
CVE-2026-12064 | High | 7.5 | 2026-07-03 | When a user invokes curl using a schemeless URL combined with
`--proto-default` sftp (or scp), a disconnect occurs between the tool layer
and libcurl. The tool… |
CVE-2026-11564 | Critical | 9.1 | 2026-07-03 | libcurl keeps previously used connections in a connection pool for subsequent
transfers to reuse if one of them matches the setup.
An easy handle that first u… |
CVE-2026-8480 | Medium | 4.3 | 2026-07-01 | A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included)
A revo… |
CVE-2026-12374 | | | 2026-07-01 | Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1… |
CVE-2026-48934 | Medium | 4.3 | 2026-06-26 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
This vulnerability affects all supported release lines: **… |
CVE-2026-7532 | High | 7.5 | 2026-06-25 | iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certi… |
CVE-2026-10098 | Medium | 5.3 | 2026-06-25 | OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial t… |
CVE-2026-6731 | High | 7.5 | 2026-06-25 | X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name cons… |
CVE-2026-6450 | Medium | 5.3 | 2026-06-25 | A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled cri… |
CVE-2026-55964 | Medium | 5.3 | 2026-06-25 | Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key… |
CVE-2026-55960 | High | 7.5 | 2026-06-25 | Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelat… |
CVE-2026-11310 | High | 7.5 | 2026-06-25 | X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (O… |
CVE-2026-10592 | Medium | 5.3 | 2026-06-25 | Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by t… |
CVE-2026-6091 | Medium | 6.5 | 2026-06-25 | Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An… |
CVE-2026-11999 | High | 7.5 | 2026-06-25 | X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with… |
CVE-2026-46734 | High | 7.3 | 2026-06-25 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with… |
CVE-2026-57289 | Medium | 4.8 | 2026-06-24 | Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending B… |
CVE-2026-54323 | Medium | 5.9 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementa… |
CVE-2026-54100 | High | 8.3 | 2026-06-22 | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nod… |
CVE-2025-2669 | Medium | 6.0 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and… |
CVE-2026-9697 | High | 7.4 | 2026-06-17 | Impact:
undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection t… |
CVE-2024-47477 | Medium | 6.5 | 2026-06-17 | Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentiall… |
CVE-2025-71261 | High | 8.6 | 2026-06-16 | An attacker with network-level access between the SUSE Virtualization
and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshak… |
CVE-2026-9259 | Medium | 6.5 | 2026-06-16 | Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9258 | Medium | 6.5 | 2026-06-16 | Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-45389 | High | 7.4 | 2026-06-15 | In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), whi… |
CVE-2026-45388 | Critical | 9.1 | 2026-06-15 | In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certif… |
CVE-2026-45170 | High | 8.8 | 2026-06-12 | Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be… |
CVE-2026-45175 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker coul… |
CVE-2026-40992 | Medium | 5.0 | 2026-06-11 | Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properti… |
CVE-2026-53475 | Critical | 9.3 | 2026-06-10 | A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. Th… |
CVE-2026-9758 | High | 7.3 | 2026-06-10 | Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted |
CVE-2026-41714 | Medium | 4.0 | 2026-06-10 | Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encrypti… |
CVE-2026-42769 | Medium | 5.3 | 2026-06-09 | Issue Summary: An error in the callback used to verify the certificate
provided in a Root CA key update Certificate Management Protocol (CMP)
message response… |
CVE-2026-50752 | High | 7.4 | 2026-06-08 | A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to… |
CVE-2026-45745 | High | 8.0 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electr… |
CVE-2026-44393 | High | 7.4 | 2026-06-04 | An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when co… |
CVE-2026-41859 | High | 7.8 | 2026-06-04 | A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper… |
CVE-2026-49267 | Medium | 5.9 | 2026-06-01 | Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate… |
CVE-2026-47074 | | | 2026-05-28 | Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validati… |
CVE-2026-42790 | High | 8.1 | 2026-05-27 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject Com… |
CVE-2026-42791 | Low | 3.7 | 2026-05-27 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certi… |
CVE-2026-42789 | Medium | 4.8 | 2026-05-27 | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as… |