CWE-295
CVEs classified under CWE-295, newest first.
358 CVEsRSS
CVE-2026-108326Medium· 6.5Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
CVE-2026-41022Medium· 5.9Eaton easySoft improperly validates TLS certificates presented by easyE4 devices
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between ea…
CVE-2026-115216Critical· 9.1Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate…
CVE-2026-111459High· 7.6Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could…
CVE-2025-13833High· 7.7Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fi…
CVE-2026-115930Medium· 6.8MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mo…
CVE-2026-115693Critical· 9.1Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. ha…
CVE-2026-115996Low· 3.7Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improp…
CVE-2026-115929Medium· 6.8MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.5…
CVE-2026-106072Medium· 6.7PoCnodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host …
CVE-2026-107685Critical· 9.1WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate…
CVE-2026-114611Critical· 9.1OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment…
CVE-2026-106017Medium· 6.3Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
CVE-2026-114220Critical· 9.1NewType Infortech｜NT OneAPP - Improper Certificate Validation
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostna…
CVE-2026-96375Medium· 4.8Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-87944Medium· 4.8SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-114642High· 8.7Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's bac…
CVE-2026-105483High· 7.4PoCnodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the in…
CVE-2026-106069High· 7.4PoCnodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause c…
CVE-2026-91403Critical· 9.1PoC⚖ disputedVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21…
CVE-2026-114406Medium· 6.8Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued…
CVE-2026-111815Critical· 10.0Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-111814Critical· 10.0Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server…
CVE-2026-114047Medium· 6.8FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept …
CVE-2026-111943Medium· 6.8PoCcrypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signe…
CVE-2026-87866NonewolfSSL public-key pinning bypass
When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certif…
CVE-2026-87865Noneknownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
CVE-2026-113812NoneMozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificate…
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-6q48-6c7w-9gw2Criticalcertifi bundles emSign root CAs with compromised intermediate CA keys
certifi bundles emSign root CAs with compromised intermediate CA keys