Medium severityNVD Advisory· Published Oct 29, 2026· Updated Oct 29, 2026
CVE-2026-106036
CVE-2026-106036
Description
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.0 build 708
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.