CVE-2026-16754 | Medium | 4.8 | 2026-10-16 | A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could al… |
CVE-2026-109383 | High | 7.4 | 2026-10-15 | undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its… |
CVE-2025-23390 | Medium | 6.3 | 2026-10-15 | A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if… |
CVE-2023-32198 | High | 8.0 | 2026-10-15 | A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote ser… |
CVE-2026-19377 | | | 2026-10-15 | Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server… |
CVE-2026-105236 | | | 2026-10-14 | Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to… |
CVE-2026-91881 | Critical | 9.0 | 2026-10-14 | Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An una… |
CVE-2026-103294 | Medium | 5.9 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100123 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100122 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100121 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100118 | High | 7.5 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-100116 | Medium | 5.9 | 2026-10-13 | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever… |
CVE-2026-77816 | Medium | 6.5 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit thi… |
CVE-2026-96222 | High | 7.4 | 2026-10-13 | Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-83926 | Medium | 4.4 | 2026-10-13 | Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally. |
CVE-2026-70194 | Medium | 6.5 | 2026-10-13 | Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-108185 | High | 7.4 | 2026-10-13 | Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via netw… |
CVE-2026-108184 | High | 7.4 | 2026-10-13 | Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access. |
CVE-2026-78556 | High | 7.4 | 2026-10-13 | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server cert… |
CVE-2026-84418 | High | 7.4 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture t… |
CVE-2026-109423 | High | 7.4 | 2026-10-12 | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a net… |
CVE-2026-109245 | Medium | 6.8 | 2026-10-12 | FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS h… |
CVE-2026-109399 | High | 8.1 | 2026-10-12 | SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certif… |
CVE-2026-103503 | | | 2026-10-12 | Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issue… |
CVE-2026-103502 | | | 2026-10-12 | Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or an… |
CVE-2026-78020 | High | 7.5 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated a… |
CVE-2026-96207 | Critical | 10.0 | 2026-10-08 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-84032 | Medium | 5.6 | 2026-10-08 | IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation. |
CVE-2026-107318 | High | 7.4 | 2026-10-08 | @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS tran… |
CVE-2026-95210 | Critical | 9.1 | 2026-10-08 | Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions. |
CVE-2026-95208 | High | 7.5 | 2026-10-08 | An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via pr… |
CVE-2026-107587 | Medium | 5.9 | 2026-10-08 | Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-enc… |
CVE-2026-87425 | Medium | 6.8 | 2026-10-08 | An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Author… |
CVE-2026-92543 | | | 2026-10-07 | Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CID… |
CVE-2026-63697 | High | 7.6 | 2026-10-06 | Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could p… |
CVE-2026-67270 | High | 8.2 | 2026-10-06 | Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unau… |
CVE-2026-105794 | | | 2026-10-06 | MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using… |
CVE-2026-105223 | High | 7.4 | 2026-10-05 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks cert… |
CVE-2026-105222 | High | 7.4 | 2026-10-04 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to… |
CVE-2026-105221 | High | 7.4 | 2026-10-04 | The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_c… |
CVE-2026-105218 | High | 7.4 | 2026-10-04 | gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payme… |
CVE-2026-105217 | Low | 3.1 | 2026-10-04 | Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the wo… |
CVE-2026-105216 | High | 7.4 | 2026-10-04 | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS he… |
CVE-2026-71889 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle… |
CVE-2026-71885 | | | 2026-10-03 | In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_k… |
CVE-2026-85088 | | | 2026-10-02 | Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.
Both libraries install a default access manager for clien… |
CVE-2026-85087 | | | 2026-10-02 | Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0… |
CVE-2026-85086 | | | 2026-10-02 | Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apac… |
CVE-2026-80443 | High | 7.4 | 2026-10-02 | Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM).
This issue affects Sef - AI Ch… |
CVE-2026-63577 | | | 2026-10-02 | Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc… |
CVE-2026-63576 | | | 2026-10-02 | Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-co… |
CVE-2026-103602 | | | 2026-10-02 | Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or c… |
CVE-2026-102671 | Medium | 5.3 | 2026-10-01 | The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default. |
CVE-2026-102668 | Medium | 5.3 | 2026-10-01 | The Joyland AI app accepts any TLS certificates from any server without validation. |
CVE-2026-15911 | High | 7.4 | 2026-10-01 | Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate v… |
CVE-2026-103921 | High | 7.4 | 2026-10-01 | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function… |
CVE-2026-10726 | | | 2026-09-30 | Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, r… |
CVE-2026-92868 | Medium | 6.5 | 2026-09-30 | An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication. |
CVE-2026-102508 | | | 2026-09-30 | Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a netwo… |
CVE-2026-86131 | Critical | 9.8 | 2026-09-30 | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server t… |
CVE-2026-97687 | High | 8.1 | 2026-09-29 | urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cer… |
CVE-2026-73594 | Medium | 6.4 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Validation vulnerabili… |
CVE-2026-101916 | High | 7.4 | 2026-09-28 | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distingu… |
CVE-2026-93302 | High | 8.2 | 2026-09-27 | MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEE… |
CVE-2026-89135 | Medium | 6.5 | 2026-09-27 | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sib… |
CVE-2026-89134 | Critical | 9.1 | 2026-09-27 | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-a… |
CVE-2026-89133 | Medium | 5.3 | 2026-09-27 | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints extensions when… |
CVE-2026-89102 | Medium | 6.5 | 2026-09-27 | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate… |
CVE-2026-100835 | High | 7.4 | 2026-09-27 | Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained t… |
CVE-2026-100701 | Medium | 5.9 | 2026-09-26 | Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-speci… |
CVE-2026-100665 | High | 7.5 | 2026-09-26 | Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a pla… |
CVE-2026-100551 | High | 8.3 | 2026-09-26 | OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gate… |
CVE-2026-84465 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… |
CVE-2026-93291 | Critical | 9.4 | 2026-09-24 | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary co… |
CVE-2026-82157 | High | 8.3 | 2026-09-24 | Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with a… |
CVE-2026-77707 | Medium | 5.9 | 2026-09-24 | Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).
This issue affects Liman Render Engi… |
CVE-2026-67404 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls… |
CVE-2026-67231 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that ov… |
CVE-2026-73587 | Medium | 6.8 | 2026-09-23 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated a… |
CVE-2026-91812 | High | 7.9 | 2026-09-23 | A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks… |
CVE-2026-18173 | Low | 3.7 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutua… |
CVE-2026-83964 | Medium | 6.2 | 2026-09-22 | Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage thi… |
CVE-2026-63374 | | | 2026-09-22 | AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStre… |
CVE-2026-65129 | Medium | 6.7 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this… |
CVE-2026-65118 | High | 7.5 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this… |
CVE-2026-84081 | High | 8.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation. |
CVE-2026-84975 | High | 7.4 | 2026-09-18 | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/ssl_sock_os… |
CVE-2026-93601 | Low | 2.2 | 2026-09-18 | rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS na… |
CVE-2026-93600 | Low | 2.2 | 2026-09-18 | rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to U… |
CVE-2026-40539 | High | 7.1 | 2026-09-18 | An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allo… |
CVE-2026-81868 | Medium | 6.5 | 2026-09-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security… |
CVE-2026-81447 | Medium | 6.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with a… |
CVE-2026-81871 | | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LO… |
CVE-2026-20323 | High | 8.3 | 2026-09-16 | A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated… |
CVE-2026-86474 | | | 2026-09-16 | The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker t… |
CVE-2026-13327 | High | 8.3 | 2026-09-15 | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to in… |
CVE-2026-84850 | Medium | 4.8 | 2026-09-15 | Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a… |
CVE-2026-61668 | High | 8.1 | 2026-09-15 | DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities… |
CVE-2026-52724 | | | 2026-09-15 | Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Un… |