CWE-295
CVEs classified under CWE-295, newest first.
359 CVEsRSS
CVE-2026-1501Low· 3.7IBM Concert Software Improper Certificate Validation
IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.
CVE-2026-112105Low· 3.7GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation
A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation.…
CVE-2026-85247Medium· 5.9PoCApache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore wa…
CVE-2026-112106Low· 3.7TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation
A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler.…
CVE-2026-112103Low· 3.7f3-factory fatfree-core HTTP Client web.php _curl certificate validation
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack…
CVE-2026-112037Low· 3.7PoCdiem-project diem Google Analytics Client gapi.class.php certificate validation
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a mani…
CVE-2026-112006Medium· 6.5OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the…
CVE-2026-16754Medium· 4.8A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
CVE-2026-109383High· 7.4undici is an HTTP client library for Node.js
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to…
CVE-2025-23390Medium· 6.3A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file
A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the exe…
CVE-2023-32198High· 8.0A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man…
CVE-2026-19377Medium· 6.0Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
CVE-2026-102476Critical· 9.1In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL prop…
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL prop…
CVE-2026-105236Medium· 6.3Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its…
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its…
CVE-2026-91881Critical· 9.0Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulner…
CVE-2026-97629Medium· 6.5PoCDescription When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticate…
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticate…
CVE-2026-103294Medium· 5.9CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…
CVE-2026-100123High· 7.5CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…
CVE-2026-100122High· 7.5CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…
CVE-2026-100121High· 7.5CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…
CVE-2026-100118High· 7.5CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…
CVE-2026-100116Medium· 5.9CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…
CVE-2026-77816Medium· 6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVE-2026-96222High· 7.4Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-83926Medium· 4.4Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.
Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.
CVE-2026-70194Medium· 6.5Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-108131High· 7.5No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-108185High· 7.4Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
CVE-2026-108184High· 7.4Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
CVE-2026-78556High· 7.4A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept…