CWE-295
Improper Certificate Validation
Description
The product does not validate, or incorrectly validates, a certificate.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-459 · CAPEC-475
CVEs mapped to this weakness (1,508)
page 33 of 76| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-66760 | Med | 0.42 | 6.4 | 0.00 | Aug 11, 2026 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack… | ||
| CVE-2026-66404 | Med | 0.42 | 6.5 | 0.00 | Aug 10, 2026 | DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved. | ||
| CVE-2025-9291 | Med | 0.42 | 6.5 | 0.00 | Aug 3, 2026 | A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow… | ||
| CVE-2026-52688 | Hig | 0.42 | 7.5 | 0.00 | Jul 23, 2026 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | ||
| CVE-2026-12064 | Hig | 0.42 | 7.5 | 0.00 | Jul 3, 2026 | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options… | ||
| CVE-2026-50149 | mod | 0.42 | 6.5 | — | Jul 2, 2026 | contour: Contour: JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration | ||
| CVE-2026-7532 | Hig | 0.42 | 7.5 | 0.00 | Jun 25, 2026 | iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints. | ||
| CVE-2026-6731 | Hig | 0.42 | 7.5 | 0.00 | Jun 25, 2026 | X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted. | ||
| CVE-2026-55960 | Hig | 0.42 | 7.5 | 0.00 | Jun 25, 2026 | Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative() accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually… | ||
| CVE-2026-11310 | Hig | 0.42 | 7.5 | 0.00 | Jun 25, 2026 | X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (OPENSSL_EXTRA) and whose application validates certificates by calling X509_verify_cert() with caller-supplied untrusted… | ||
| CVE-2026-11999 | Hig | 0.42 | 7.5 | 0.00 | Jun 25, 2026 | X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untrusted intermediates; for those… | ||
| CVE-2024-47477 | Med | 0.42 | 6.5 | 0.00 | Jun 17, 2026 | Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to man-in-the-middle attack in tandem with DNS cache poisoning. | ||
| CVE-2026-9259 | Med | 0.42 | 6.5 | 0.00 | Jun 16, 2026 | Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier | ||
| CVE-2026-9258 | Med | 0.42 | 6.5 | 0.00 | Jun 16, 2026 | Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier | ||
| CVE-2026-47077 | Hig | 0.42 | 7.5 | 0.01 | May 25, 2026 | Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on… | ||
| CVE-2026-23998 | Hig | 0.42 | 7.5 | 0.00 | May 14, 2026 | Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to… | ||
| CVE-2026-0249 | Med | 0.42 | 6.5 | 0.00 | May 13, 2026 | Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an… | ||
| CVE-2025-42611 | Med | 0.42 | 6.5 | 0.00 | May 5, 2026 | RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate… | ||
| CVE-2026-32281 | Hig | 0.42 | 7.5 | 0.00 | Apr 8, 2026 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root… | ||
| CVE-2026-35389 | Hig | 0.42 | 7.5 | 0.00 | Apr 6, 2026 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid… |
- risk 0.42cvss 6.4epss 0.00
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack…
- risk 0.42cvss 6.5epss 0.00
DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
- risk 0.42cvss 6.5epss 0.00
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow…
- risk 0.42cvss 7.5epss 0.00
RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
- risk 0.42cvss 7.5epss 0.00
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options…
- risk 0.42cvss 6.5epss —
contour: Contour: JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration
- risk 0.42cvss 7.5epss 0.00
iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints.
- risk 0.42cvss 7.5epss 0.00
X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.
- risk 0.42cvss 7.5epss 0.00
Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative() accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually…
- risk 0.42cvss 7.5epss 0.00
X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (OPENSSL_EXTRA) and whose application validates certificates by calling X509_verify_cert() with caller-supplied untrusted…
- risk 0.42cvss 7.5epss 0.00
X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untrusted intermediates; for those…
- risk 0.42cvss 6.5epss 0.00
Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to man-in-the-middle attack in tandem with DNS cache poisoning.
- risk 0.42cvss 6.5epss 0.00
Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier
- risk 0.42cvss 6.5epss 0.00
Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier
- risk 0.42cvss 7.5epss 0.01
Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap. The after Timeout clause is a per-message inactivity timer that resets on…
- risk 0.42cvss 7.5epss 0.00
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to…
- risk 0.42cvss 6.5epss 0.00
Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an…
- risk 0.42cvss 6.5epss 0.00
RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate…
- risk 0.42cvss 7.5epss 0.00
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root…
- risk 0.42cvss 7.5epss 0.00
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid…