CVE-2026-70454 is a high-severity vulnerability in Rsync versions 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) involving improper TLS certificate validation. The flaw allows on-path attackers to intercept encrypted sessions by using self-signed or invalid certificates due to failure to properly validate server TLS certificates against trusted CAs and verify hostname matching. This can lead to decryption or tampering of rsync session content without client detection.
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.
The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain.
Please note the classic version of HttpClient is not affected by this vulnerability.
Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue.
An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute. Successful exploitation could allow impersonation of a trusted internal component, resulting in a high impact on integrity and a low impact on confidentiality and availability.
Dell RVTools versions prior to 4.8.1 contain an improper certificate validation vulnerability in the collector component. This vulnerability could allow a remote unauthenticated attacker to compromise confidentiality and integrity. The CVSS score is 6.8, indicating a medium severity issue. No official patch or remediation guidance has been provided yet by Dell. There are no known exploits in the wild at this time.
CVE-2026-16792 is an improper certificate validation vulnerability in multiple Lenovo XClarity Orchestrator 2.2.0 microservices. This flaw could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack on HTTPS connections during TLS certificate validation under certain conditions. The vulnerability has a medium severity score of 6.1 and no known exploits in the wild. No official patch or remediation guidance has been provided yet.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
CVE-2025-9291 is a high-severity vulnerability in TP-Link Omada Gateways involving improper certificate validation. The affected devices do not adequately verify that a presented certificate matches the expected cloud controller hostname. This weakness could allow an attacker to bypass certificate validation protections under certain conditions, potentially enabling interception or modification of communications between the devices and cloud controllers.
Net::SAML2 versions before 0.86 for Perl contain a vulnerability that allows SAML authentication bypass. The verify_xml function verifies responses against a certificate embedded within the response itself when no trust anchor is configured, enabling attackers to authenticate arbitrary assertions using self-signed certificates. This occurs because the code returns early if no trust anchors or CA certificates are provided, trusting the embedded certificate without external validation.
eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protected. On each launch the application fetches an
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive
TrustManager and a HostnameVerifier that always returns true), does not verify
any digital signature on the update descriptor, and does not verify the
Authenticode signature or a checksum of the downloaded installer before running
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a
crafted update descriptor pointing to an attacker-controlled executable, which
the client downloads and executes, resulting in arbitrary code execution on the
victim host.
CVE-2026-58062 is a critical vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library involving improper certificate validation. Specifically, in versions before 1.85 (and corresponding LTS and FIPS versions), the library accepts stapled OCSP responses without properly binding them to the certificate being checked. This flaw affects multiple branches of BC-JAVA and has been fixed in versions 1.85, 2.73.12, 2.0.2, and 2.1.3.
CVE-2026-8763 is a critical vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library affecting versions prior to 1.85 and certain LTS and FIPS releases. The flaw involves improper certificate validation, specifically a Name Constraints bypass via a trailing dot in rfc822Name and URI fields. This vulnerability allows attackers to bypass certificate restrictions, potentially undermining TLS/SSL security. It has a high CVSS 4.0 score of 9.3, indicating network exploitable, no privileges required, and no user interaction needed. Fixed versions are available for all affected branches.
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.