CVE-2025-49015Medium· 4.9▾ SunlitCouchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.2%
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
CouchbaseNetClient < 3.7.1Upgrade to a patched release:
CouchbaseNetClient 3.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
CVE-2026-106069High· 7.4nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
CVE-2026-66392NoneApache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
CVE-2026-86410Noneredirect to SFTP or SCP bypasses host verification
CVE-2025-25253Medium· 6.8An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and be…
CVE-2024-2466Medium· 6.5libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS