Applied Systems Engineering ASE2000 V2 versions 2.25 through 2.37 contain an improper certificate validation vulnerability. This flaw may allow an attacker to impersonate a trusted peer during the TLS handshake, potentially enabling the attacker to read or modify protected communications. The vulnerability is identified as CWE-295 and has a CVSS 3.1 score of 7.4, indicating high severity. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.
Dell PowerProtect One versions 20.1.0.0 and below have an improper certificate validation vulnerability (CWE-295). This flaw could allow an unauthenticated remote attacker to bypass protection mechanisms. The vulnerability has a medium severity with a CVSS score of 5.9. No official patch or remediation guidance has been provided yet.
CVE-2026-54548 is a medium severity vulnerability in Siemens kas, a setup tool for bitbake-based projects. Versions prior to 5.4 improperly configure SSH by adding a global 'Host *' rule with 'StrictHostKeyChecking no' to ~/.ssh/config when no user-specific SSH configuration exists. This setting persists beyond the intended short-lived environment, causing subsequent SSH connections to accept host keys without verification. This increases the risk of man-in-the-middle attacks compromising session confidentiality and integrity. The issue is fixed in kas version 5.4.
NVIDIA NemoClaw for Linux has a vulnerability involving improper certificate validation during its deployment process. Exploiting this flaw could allow attackers to disclose information, tamper with data, execute code, and escalate privileges. The vulnerability is tracked as CVE-2026-65084 and is rated with a high severity CVSS score of 8.1. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.
A vulnerability in JSS (Java Security Services) affects the JSSTrustManager class, which fails to verify NSS trust flags when validating CA certificates. This flaw allows certificates in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In configurations where certificate revocation checking is disabled, this could enable a man-in-the-middle attacker to forge certificates accepted by PKI client connections. The issue has a CVSS score of 6.5, indicating medium severity.
CVE-2026-17024 is a high-severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 involving improper certificate validation. This flaw could allow a remote attacker to execute arbitrary code on affected systems without user interaction. The vulnerability stems from a failure to properly validate certificates, potentially enabling unauthorized code execution.
CVE-2026-53583 is a vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5 involving improper certificate validation. Specifically, the verify_server_cert function incorrectly compares IP-literal hosts with certificate IP SubjectAltNames when using OpenSSL, causing valid IP matches to be rejected and mismatched IP addresses to be accepted. This flaw allows a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. The issue is fixed in libgit2 versions 1.8.6 and 1.9.5.
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.
Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.
CVE-2026-16822 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, involving improper certificate validation. This flaw could allow a remote attacker to impersonate the TNC policy server and modify network traffic. The vulnerability has a high CVSS score of 9.3, indicating significant risk. No information about available patches or vendor advisories is provided.
IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 contain a vulnerability in the FSP management network protocol. This flaw allows an unauthenticated attacker on the management network to bypass authentication and perform any administrative operation on the managed system. The attacker can control partition power state, configuration, and console access across all hosted partitions, impacting confidentiality, integrity, and availability.
CVE-2026-49283 is a high-severity vulnerability in the SimpleSAMLphp SAML2 PHP library affecting versions prior to 4.19.3, 4.20.2, 5.0.6, and 6.2.1. It involves improper certificate validation in the HTTPArtifact::receive() flow, allowing an attacker controlling a lower-trust identity provider (IdP) in a multi-IdP federation to impersonate a higher-trust victim IdP. This is achieved by providing an unsigned embedded SAML Response that is incorrectly treated as valid, enabling authentication as arbitrary users with attacker-chosen attributes. The issue is fixed in the specified versions.
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.
CVE-2026-50149 is a vulnerability in projectcontour's Contour Kubernetes ingress controller versions 1.23.0 through 1.33.4. It occurs when an HTTPProxy resource is configured with both .spec.virtualhost.tls.enableFallbackCertificate set to true and .spec.virtualhost.jwtProviders, which Contour does not reject. This misconfiguration allows requests without valid TLS SNI or with unrecognized SNI to bypass JWT verification and be proxied to upstream services without a valid token. The issue is fixed in version 1.33.5, where such configurations are rejected with an error status. A workaround is to avoid enabling enableFallbackCertificate when jwtProviders are defined.
CVE-2026-11751 is a critical vulnerability in LY Corporation's Armeria product affecting armeria-xds versions prior to 1.41.0. The flaw involves the silent disabling of TLS peer verification for xDS upstream connections, which could allow man-in-the-middle attacks. This vulnerability is identified as CWE-295 and has a CVSS 4.0 score of 9.1, indicating high impact and exploitability under certain conditions.
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0.
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between the DiGA backend and the ePA system can intercept the VAU handshake, supply attacker-controlled certificate and key material, and satisfy the circular trust relationship. Because TLS certificate verification is also disabled in affected versions, no independent server-authentication layer prevents the attack. The attacker can impersonate the VAU server, control the negotiated session keys, and read or modify all encrypted VAU traffic. This issue is fixed in version 1.3.0.
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.
erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could present any certificate and impersonate any server, defeating the confidentiality and integrity of the connection. HTTP/3 uses the same client and was equally affected. Handshakes authenticated by a PSK (session resumption) are not affected, because the peer is authenticated by the PSK binder and no certificate is sent. This is fixed in 1.4.4. The client now verifies the CertificateVerify signature, validates the certificate chain against the trust store (`cacerts` option, the operating system store by default), and checks the hostname. Client `verify` now defaults to on; set `verify => false` to accept any certificate (for example a self-signed test server). No known workarounds are available before 1.4.4. `verify => true` had no effect, and inspecting the certificate after connecting does not help because without the signature check the peer is never proven to own the certificate it presents.
CVE-2026-54481 is a vulnerability in Gitea Open Source Git Server where the internal API HTTP client is configured to skip TLS certificate verification (InsecureSkipVerify:true) without an option to override this behavior. This flaw corresponds to CWE-295, indicating improper certificate validation. It affects Gitea versions from 0 up to and including 1.26.4 and has a high severity with a CVSS score of 7.5.