cve.bz

CWE-295: Improper Certificate Validation, page 6

Filter

The product does not validate, or incorrectly validates, a certificate.

What the weakness is: CWE-295 at MITRE

Ask an AI about CWE-295

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-295: Improper Certificate Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/295.html and https://cve.bz/cve/cwe/295?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.3CVE-2026-66406EPSS 0.2%

    DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be execu…

  2. 6.0CVE-2026-66404EPSS 0.2%

    DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

  3. 9.1CVE-2026-64993EPSS 0.2%

    Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integri…

  4. 7.0CVE-2026-16792EPSS 0.1%

    An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-i…

  5. 6.9CVE-2026-69248EPSS 0.2%

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has…

  6. 9.1CVE-2026-67598EPSS 0.3%

    Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary…

  7. 7.7CVE-2025-9291EPSS 0.2%

    A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud…

  8. 7.5CVE-2026-18089EPSS 0.2%

    Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured. verify_xml in Net::SAML2::Role::VerifyXML runs "r…

  9. 7.3CVE-2026-0392EPSS 0.09%

    eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS bu…

  10. 9.3CVE-2026-58062EPSS 0.4%

    In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.…

  11. 9.3CVE-2026-8763EPSS 0.4%

    In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.…

  12. 9.3CVE-2026-67294EPSS 0.4%

    FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails,…

  13. 9.3CVE-2026-67293EPSS 0.2%

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.…

  14. 9.3CVE-2026-66402EPSS 0.3%

    FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common …

  15. 8.2CVE-2026-18141EPSS 0.4%

    A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achiev…

  16. 7.4CVE-2026-8497EPSS 0.1%

    Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive informati…

  17. 5.6CVE-2026-18257EPSS 0.2%

    Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted

  18. 8.4CVE-2026-58162EPSS 0.4%

    The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Us…

  19. 6.3CVE-2026-65325EPSS 0.3%

    Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. …

  20. 5.9CVE-2026-16107EPSS 0.2%

    IBM TS4500 CLI tool Versions:  0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

  21. 8.1CVE-2026-54342EPSS 0.2%

    In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections…

  22. 9.1CVE-2026-48021EPSS 0.2%

    In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HT…

  23. 7.5CVE-2026-52688EPSS 0.2%

    RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

  24. 9.1CVE-2026-56820EPSS 0.3%

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response …

  25. 8.0CVE-2026-60648EPSS 0.2%

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privil…

  26. 7.3CVE-2026-56624EPSS 0.3%

    Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSH…

  27. 9.1CVE-2026-46428EPSS 0.3%

    lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict)…

  28. 8.2CVE-2026-13410EPSS 0.4%

    Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability betwe…

  29. 5.3CVE-2026-38974EPSS 0.3%

    Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

  30. 9.5CVE-2026-13385EPSS 0.1%

    An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middle(MITM) user to make the router download and execute arbitrary command via a spoofed server. …

  31. 6.5CVE-2026-50302EPSS 0.3%

    Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.

  32. 7.8CVE-2026-55001EPSS 0.3%

    Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.

  33. 8.8CVE-2026-47632EPSS 0.5%

    Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

  34. 9.8CVE-2026-59836EPSS 0.2%

    A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>

  35. 7.5CVE-2026-15683EPSS 0.1%

    Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi…

  36. 9.5CVE-2026-22093EPSS 0.3%

    The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate …

  37. 7.4CVE-2026-54919EPSS 0.3%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPH…

  38. 5.7CVE-2026-0277EPSS 0.2%

    An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. The Prisma Access Agent on Windows, macOS, Linux, Android and…

  39. 8.1CVE-2026-59818EPSS 0.4%

    etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-cr…

  40. 7.4CVE-2026-55436EPSS 0.3%

    Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose defau…

  41. 9.1CVE-2026-6900EPSS 0.2%

    Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.

  42. 8.1CVE-2026-8286EPSS 0.3%

    A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

  43. 7.5CVE-2026-12064EPSS 0.4%

    When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initial…

  44. 9.1CVE-2026-11564EPSS 0.6%

    libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store afte…

  45. 4.3CVE-2026-8480EPSS 0.1%

    A vulnerability was discovered on Stormshield Network Security 4.3.0  to 4.3.41 (included), 4.4.0 to 4.8.15 (included) , 5.0.2 EA to 5.0.5 (included) A revoked client certificate can still be used to authenticate to the captive‑admin po…

  46. 6.4CVE-2026-12374EPSS 0.07%

    Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root vi…

  47. 4.3CVE-2026-48934EPSS 0.3%

    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

  48. 5.7CVE-2026-7532EPSS 0.3%

    iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints.

  49. 6.3CVE-2026-10098EPSS 0.2%

    OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup co…

  50. 6.0CVE-2026-6731EPSS 0.1%

    X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.