CWE-295 · Improper Certificate Validation

1483 CVEs classified under CWE-295 (Improper Certificate Validation). Browse by severity and year.

Top CVEs for CWE-295
CVESeverityScorePublishedSummary
CVE-2026-58162Critical10.02026-07-29The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0…
CVE-2026-4370Critical10.02026-04-01A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to pe…
CVE-2026-30836Critical10.02026-03-19Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unau…
CVE-2025-68121Critical10.02026-02-05During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed han…
CVE-2022-20703Critical10.02022-02-10Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbi…
CVE-2021-1471Critical9.92021-03-24Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrar…
CVE-2026-66402Critical9.82026-08-01FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hos…
CVE-2026-32253Critical9.82026-05-22Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because o…
CVE-2026-20184Critical9.82026-04-15A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to i…
CVE-2026-2590Critical9.82026-03-03Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and e…
CVE-2025-67229Critical9.82026-01-23An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof ba…
CVE-2025-46070Critical9.82026-01-12An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component
CVE-2025-29331Critical9.82025-06-26An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check cert…
CVE-2025-6433Critical9.82025-06-24If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would…
CVE-2025-32878Critical9.82025-06-20An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for download…
CVE-2024-56521Critical9.82024-12-27An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
CVE-2024-49369Critical9.82024-11-12Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The…
CVE-2019-20461Critical9.82024-11-07An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device uses a custom UDP protocol to start and control video and audio services. The protocol…
CVE-2024-45159Critical9.82024-09-05An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certifi…
CVE-2024-42395Critical9.82024-08-06There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit…
All CVEs classified under CWE-295 — newest first (page 1 of 15)
CVESeverityScorePublishedSummary
CVE-2026-636502026-08-14OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup…
CVE-2026-49457Critical9.12026-08-14erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The Cer…
CVE-2026-54481High7.52026-08-13Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
CVE-2026-70454High8.02026-08-13rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path atta…
CVE-2026-02962026-08-13Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) acces…
CVE-2026-186792026-08-12When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disab…
CVE-2026-186782026-08-12When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over…
CVE-2026-71290Critical9.12026-08-11Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when us…
CVE-2026-66154High8.32026-08-11An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions…
CVE-2026-48437Medium5.52026-08-11CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could lever…
CVE-2026-118142026-08-11A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffi…
CVE-2026-18129High8.12026-08-11Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MI…
CVE-2026-15554High7.42026-08-11the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated…
CVE-2026-66760Medium6.42026-08-11SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same t…
CVE-2026-66410Medium4.82026-08-10Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.
CVE-2026-66406Medium4.82026-08-10DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter c…
CVE-2026-66404Medium6.52026-08-10DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products…
CVE-2026-64993Medium6.82026-08-06Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could poten…
CVE-2026-16792Medium6.12026-08-04An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent…
CVE-2026-692482026-08-03cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA perm…
CVE-2026-67598High7.42026-08-03Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to inter…
CVE-2025-9291Medium6.52026-08-03A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not ad…
CVE-2026-18089High7.52026-08-03Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when n…
CVE-2026-03922026-08-03eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protecte…
CVE-2026-580622026-08-03In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Jav…
CVE-2026-87632026-08-03In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS befor…
CVE-2026-67294Medium5.92026-08-01FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_u…
CVE-2026-67293Medium4.22026-08-01FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hos…
CVE-2026-66402Critical9.82026-08-01FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hos…
CVE-2026-18141High8.22026-07-31A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual…
CVE-2026-8497High7.42026-07-29Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS…
CVE-2026-18257Medium5.62026-07-29Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to b…
CVE-2026-58162Critical10.02026-07-29The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0…
CVE-2026-65325Medium4.82026-07-29Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affect…
CVE-2026-16107Medium5.92026-07-28IBM TS4500 CLI tool Versions:  0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to o…
CVE-2026-54342High8.12026-07-24In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a s…
CVE-2026-48021Critical9.12026-07-24In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake wi…
CVE-2026-52688High7.52026-07-23RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
CVE-2026-56820High7.42026-07-21Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Fin…
CVE-2026-60648High8.02026-07-21Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar…
CVE-2026-56624High7.32026-07-20Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side Open…
CVE-2026-464282026-07-20lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration si…
CVE-2026-13410High8.22026-07-17Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicit…
CVE-2026-38974Medium5.32026-07-15Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.
CVE-2026-133852026-07-15An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user…
CVE-2026-50302Medium4.22026-07-14Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-55001High7.82026-07-14Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.
CVE-2026-47632High8.82026-07-14Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
CVE-2026-59836High7.52026-07-14A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all vers…
CVE-2026-15683High7.52026-07-13Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attack…
CVE-2026-220932026-07-13The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker o…
CVE-2026-54919High7.42026-07-10cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL…
CVE-2026-0277Medium5.92026-07-09An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to interc…
CVE-2026-59818Medium6.52026-07-08etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls…
CVE-2026-55436High7.42026-07-08Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.3…
CVE-2026-6900High7.42026-07-06Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
CVE-2026-8286High8.12026-07-03A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configurat…
CVE-2026-12064High7.52026-07-03When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool…
CVE-2026-11564Critical9.12026-07-03libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first u…
CVE-2026-8480Medium4.32026-07-01A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revo…
CVE-2026-123742026-07-01Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1…
CVE-2026-48934Medium4.32026-06-26A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **…
CVE-2026-7532High7.52026-06-25iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certi…
CVE-2026-10098Medium5.32026-06-25OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial t…
CVE-2026-6731High7.52026-06-25X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name cons…
CVE-2026-6450Medium5.32026-06-25A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled cri…
CVE-2026-55964Medium5.32026-06-25Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key…
CVE-2026-55960High7.52026-06-25Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelat…
CVE-2026-11310High7.52026-06-25X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (O…
CVE-2026-10592Medium5.32026-06-25Certificates with wildcard DNS SANs (e.g. *.example.com) bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by t…
CVE-2026-6091Medium6.52026-06-25Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An…
CVE-2026-11999High7.52026-06-25X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with…
CVE-2026-46734High7.32026-06-25Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with…
CVE-2026-57289Medium4.82026-06-24Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending B…
CVE-2026-54323Medium5.92026-06-23Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, the daemon's git clone implementa…
CVE-2026-54100High8.32026-06-22A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nod…
CVE-2025-2669Medium6.02026-06-22IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and…
CVE-2026-9697High7.42026-06-17Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection t…
CVE-2024-47477Medium6.52026-06-17Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentiall…
CVE-2025-71261High8.62026-06-16An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshak…
CVE-2026-9259Medium6.52026-06-16Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier
CVE-2026-9258Medium6.52026-06-16Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier
CVE-2026-45389High7.42026-06-15In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), whi…
CVE-2026-45388Critical9.12026-06-15In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certif…
CVE-2026-45170High8.82026-06-12Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be…
CVE-2026-45175High7.82026-06-11Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker coul…
CVE-2026-40992Medium5.02026-06-11Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properti…
CVE-2026-53475Critical9.32026-06-10A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. Th…
CVE-2026-9758High7.32026-06-10Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted
CVE-2026-41714Medium4.02026-06-10Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encrypti…
CVE-2026-42769Medium5.32026-06-09Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response…
CVE-2026-50752High7.42026-06-08A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to…
CVE-2026-45745High8.02026-06-05Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electr…
CVE-2026-44393High7.42026-06-04An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when co…
CVE-2026-41859High7.82026-06-04A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper…
CVE-2026-49267Medium5.92026-06-01Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate…
CVE-2026-470742026-05-28Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validati…
CVE-2026-42790High8.12026-05-27Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject Com…
CVE-2026-42791Low3.72026-05-27Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certi…
CVE-2026-42789Medium4.82026-05-27Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as…