CWE-295 · Improper Certificate Validation (page 3)
Page 3 of 15 — CVEs classified under CWE-295, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27138 | Medium | 5.9 | 2026-03-06 | Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. Th… |
CVE-2026-27137 | High | 7.5 | 2026-03-06 | When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different d… |
CVE-2025-40896 | Medium | 6.5 | 2026-03-04 | The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-middle attack and int… |
CVE-2026-2748 | Medium | 5.3 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 improperly validates S/MIME certificates issued for email addresses containing whitespaces, allowing signat… |
CVE-2026-2590 | Critical | 9.8 | 2026-03-03 | Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and e… |
CVE-2026-3336 | High | 7.5 | 2026-03-02 | Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objec… |
CVE-2025-67601 | High | 8.3 | 2026-02-25 | A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login… |
CVE-2026-3100 | Medium | 6.5 | 2026-02-25 | The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper valid… |
CVE-2025-67752 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper… |
CVE-2025-70058 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by… |
CVE-2025-70045 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certificate validation by… |
CVE-2025-70044 | Medium | 6.5 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3. |
CVE-2025-70043 | Critical | 9.1 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation… |
CVE-2026-27134 | High | 8.1 | 2026-02-21 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions 0.49.0 through 0.50.0, when… |
CVE-2026-27133 | Medium | 5.9 | 2026-02-20 | Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a cha… |
CVE-2026-24122 | Low | 3.7 | 2026-02-19 | Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires bef… |
CVE-2026-24734 | High | 7.5 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomc… |
CVE-2025-66614 | Critical | 9.1 | 2026-02-17 | Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 throu… |
CVE-2025-65753 | High | 7.5 | 2026-02-17 | An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root. |
CVE-2026-0872 | | 2026-02-13 | Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation.This issue… | |
CVE-2025-9293 | High | 8.1 | 2026-02-13 | A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicati… |
CVE-2025-15573 | Critical | 9.4 | 2026-02-12 | The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com… |
CVE-2026-0228 | | 2026-02-11 | An improper certificate validation vulnerability in PAN-OS allows users to connect Terminal Server Agents on Windows to PAN-OS using expired certificates even… | |
CVE-2025-70029 | High | 7.5 | 2026-02-11 | An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by se… |
CVE-2026-21228 | High | 8.1 | 2026-02-10 | Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network. |
CVE-2026-25961 | High | 7.5 | 2026-02-09 | SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE… |
CVE-2026-22613 | Medium | 5.7 | 2026-02-09 | The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Ma… |
CVE-2026-25644 | High | 7.5 | 2026-02-06 | DataHub is an open-source metadata platform. Prior to version 1.3.1.8, the LDAP ingestion source is vulnerable to MITM attack through TLS downgrade. This issue… |
CVE-2025-15323 | Low | 3.7 | 2026-02-05 | Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. |
CVE-2025-68121 | Critical | 10.0 | 2026-02-05 | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed han… |
CVE-2025-15557 | High | 8.8 | 2026-02-05 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a… |
CVE-2026-25160 | Critical | 9.1 | 2026-02-04 | Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables TLS certificate ver… |
CVE-2026-24935 | Medium | 5.6 | 2026-02-03 | A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services r… |
CVE-2026-24934 | Low | 3.7 | 2026-02-03 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP addres… |
CVE-2026-24933 | Medium | 5.9 | 2026-02-03 | The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulner… |
CVE-2026-24932 | Medium | 5.9 | 2026-02-03 | The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improp… |
CVE-2026-1778 | Medium | 5.9 | 2026-02-02 | Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python mode… |
CVE-2026-1531 | High | 8.1 | 2026-02-02 | A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certif… |
CVE-2026-1530 | High | 8.1 | 2026-02-02 | A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validati… |
CVE-2025-53869 | Low | 3.7 | 2026-01-29 | Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the… |
CVE-2022-40620 | High | 7.7 | 2026-01-28 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update pack… |
CVE-2026-22696 | | 2026-01-26 | dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a c… | |
CVE-2025-67229 | Critical | 9.8 | 2026-01-23 | An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof ba… |
CVE-2025-32057 | Medium | 6.5 | 2026-01-22 | The Infotainment ECU manufactured by Bosch which is installed in Nissan Leaf ZE1 – 2020 uses a Redbend service for over-the-air provisioning and updates. HTTPS… |
CVE-2025-27377 | Medium | 5.3 | 2026-01-22 | Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a man-in-the-middle (… |
CVE-2026-21945 | High | 7.5 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported vers… |
CVE-2025-11043 | High | 7.4 | 2026-01-19 | An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an una… |
CVE-2026-22250 | Low | 2.5 | 2026-01-12 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability… |
CVE-2025-46070 | Critical | 9.8 | 2026-01-12 | An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component |
CVE-2025-71063 | High | 8.2 | 2026-01-12 | Errands before 46.2.10 does not verify TLS certificates for CalDAV servers. |
CVE-2025-66001 | High | 8.8 | 2026-01-08 | NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) f… |
CVE-2025-14819 | Medium | 5.3 | 2026-01-08 | When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA… |
CVE-2025-13034 | Medium | 5.9 | 2026-01-08 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to v… |
CVE-2025-69412 | Low | 3.4 | 2026-01-01 | KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing… |
CVE-2025-52598 | Low | 3.7 | 2025-12-26 | Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camer… |
CVE-2025-68161 | Medium | 4.8 | 2025-12-18 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the v… |
CVE-2025-14022 | High | 7.7 | 2025-12-15 | LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK inter… |
CVE-2025-13052 | Medium | 5.9 | 2025-12-12 | When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can… |
CVE-2025-65291 | High | 7.4 | 2025-12-10 | Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discover… |
CVE-2025-65290 | High | 7.4 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downl… |
CVE-2025-65830 | Critical | 9.1 | 2025-12-10 | Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt t… |
CVE-2025-40801 | High | 8.1 | 2025-12-09 | A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All v… |
CVE-2025-40800 | High | 7.4 | 2025-12-09 | A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V25… |
CVE-2025-66491 | Medium | 5.9 | 2025-12-09 | Traefik is an HTTP reverse proxy and load balancer. Versions 3.5.0 through 3.6.2 have inverted TLS verification logic in the nginx.ingress.kubernetes.io/proxy-… |
CVE-2025-61727 | Medium | 6.5 | 2025-12-03 | An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that exc… |
CVE-2025-61729 | High | 7.5 | 2025-12-02 | Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error stri… |
CVE-2025-12893 | Medium | 4.2 | 2025-11-25 | Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Us… |
CVE-2025-44018 | High | 8.3 | 2025-11-24 | A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware dow… |
CVE-2025-65083 | Low | 3.2 | 2025-11-17 | GoSign Desktop through 2.4.1 disables TLS certificate validation when configured to use a proxy server. This can be problematic if the GoSign Desktop user sele… |
CVE-2025-60022 | Medium | 4.8 | 2025-11-17 | Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle att… |
CVE-2025-30669 | Medium | 4.8 | 2025-11-13 | Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access. |
CVE-2025-12765 | High | 7.5 | 2025-11-13 | pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification. |
CVE-2025-12047 | Medium | 5.3 | 2025-11-12 | A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an att… |
CVE-2025-10495 | High | 7.5 | 2025-11-12 | A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certa… |
CVE-2025-40744 | High | 7.5 | 2025-11-11 | A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates… |
CVE-2025-12943 | High | 7.5 | 2025-11-11 | Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band… |
CVE-2025-64685 | High | 8.1 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure |
CVE-2025-64432 | Medium | 4.7 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggrega… |
CVE-2025-56231 | Critical | 9.1 | 2025-11-05 | Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. |
CVE-2025-54470 | High | 8.6 | 2025-10-30 | This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends an… |
CVE-2025-58188 | High | 7.5 | 2025-10-29 | Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method… |
CVE-2025-62375 | | 2025-10-15 | go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS atte… | |
CVE-2025-11619 | High | 8.8 | 2025-10-15 | Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic. |
CVE-2025-62371 | High | 7.4 | 2025-10-15 | OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Pr… |
CVE-2025-6026 | Low | 3.1 | 2025-10-15 | An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting netwo… |
CVE-2025-10699 | Medium | 5.3 | 2025-10-15 | A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure. |
CVE-2025-11695 | High | 8.0 | 2025-10-13 | When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3… |
CVE-2025-11633 | Low | 3.7 | 2025-10-12 | A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the… |
CVE-2025-61778 | | 2025-10-06 | Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via ou… | |
CVE-2025-34235 | High | 7.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) c… |
CVE-2025-10548 | Medium | 6.5 | 2025-09-23 | The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer download… |
CVE-2025-34199 | High | 8.1 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) c… |
CVE-2024-13990 | | 2025-09-19 | MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust crypt… | |
CVE-2025-59353 | High | 7.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary… |
CVE-2025-59347 | Medium | 6.5 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTT… |
CVE-2025-35434 | Medium | 4.2 | 2025-09-17 | CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonat… |
CVE-2025-9708 | Medium | 6.8 | 2025-09-16 | A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Author… |
CVE-2025-55109 | Critical | 9.0 | 2025-09-16 | An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when… |
CVE-2025-50944 | High | 8.8 | 2025-09-15 | An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used… |
CVE-2025-58781 | Medium | 4.8 | 2025-09-12 | WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic. |