CWE-299 · Improper Check for Certificate Revocation
18 CVEs classified under CWE-299 (Improper Check for Certificate Revocation). Newest first, with CVSS severity, EPSS score and public exploits for each.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-1675 | High | 8.3 | 2020-10-16 | When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certi… |
CVE-2026-61699 | High | 8.1 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromi… |
CVE-2025-3085 | High | 8.1 | 2025-04-01 | A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the in… |
CVE-2026-56821 | High | 7.4 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flag… |
CVE-2026-4428 | High | 7.4 | 2026-03-19 | A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a… |
CVE-2023-23690 | High | 7.0 | 2023-01-19 | Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not n… |
CVE-2026-73581 | Medium | 6.5 | 2026-09-23 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate use… |
CVE-2020-16228 | Medium | 6.4 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550… |
CVE-2026-93493 | Medium | 5.9 | 2026-09-18 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Prot… |
CVE-2026-6899 | Medium | 5.6 | 2026-06-09 | Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper o… |
CVE-2026-94417 | Medium | 5.3 | 2026-09-27 | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certifica… |
CVE-2025-36057 | Medium | 5.2 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is no… |
CVE-2026-102221 | Medium | 4.4 | 2026-10-13 | No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-93602 | Medium | 4.4 | 2026-09-18 | rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against e… |
CVE-2024-56138 | Medium | 4.0 | 2025-01-13 | notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Q… |
CVE-2026-86231 | Low | 3.7 | 2026-09-06 | A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.j… |
CVE-2026-9636 | | 2026-07-14 | A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. T… | |
CVE-2025-11955 | | 2025-10-27 | Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN cl… |
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102221 | Medium | 4.4 | 2026-10-13 | No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-94417 | Medium | 5.3 | 2026-09-27 | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certifica… |
CVE-2026-73581 | Medium | 6.5 | 2026-09-23 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate use… |
CVE-2026-93602 | Medium | 4.4 | 2026-09-18 | rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against e… |
CVE-2026-93493 | Medium | 5.9 | 2026-09-18 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Prot… |
CVE-2026-86231 | Low | 3.7 | 2026-09-06 | A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.j… |
CVE-2026-61699 | High | 8.1 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromi… |
CVE-2026-56821 | High | 7.4 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flag… |
CVE-2026-9636 | | 2026-07-14 | A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. T… | |
CVE-2026-6899 | Medium | 5.6 | 2026-06-09 | Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper o… |
CVE-2026-4428 | High | 7.4 | 2026-03-19 | A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a… |
CVE-2025-11955 | | 2025-10-27 | Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN cl… | |
CVE-2025-36057 | Medium | 5.2 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is no… |
CVE-2025-3085 | High | 8.1 | 2025-04-01 | A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the in… |
CVE-2024-56138 | Medium | 4.0 | 2025-01-13 | notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Q… |
CVE-2023-23690 | High | 7.0 | 2023-01-19 | Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. A threat actor does not n… |
CVE-2020-1675 | High | 8.3 | 2020-10-16 | When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certi… |
CVE-2020-16228 | Medium | 6.4 | 2020-09-11 | In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550… |