CVE-2026-29140 is a high-severity vulnerability in SEPPmail Secure Email Gateway versions before 15.0.3. It involves improper certificate validation (CWE-295) that allows an attacker to insert attacker-controlled certificates into S/MIME signatures. This can cause the system to use these malicious certificates for encrypting future communications to the victim. The vulnerability has a CVSS 4.0 base score of 7.7, indicating a significant risk. No official patch or remediation link is provided in the available data, and there is no indication of known exploits in the wild. The product is not a cloud service, so remediation depends on vendor patching of on-premises software.
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.
CVE-2026-32794 is an improper certificate validation vulnerability in the Apache Airflow Provider for Databricks versions from 1.10.0 before 1.12.0. The provider did not validate certificates for connections to the Databricks back-end, which could allow a man-in-the-middle attacker to intercept or manipulate traffic or exfiltrate credentials without detection. The issue is fixed in version 1.12.0. The vulnerability has a CVSS score of 4.
CVE-2026-32884 is a medium severity vulnerability in the Botan C++ cryptography library prior to version 3.11.0. The issue involves improper certificate validation related to name constraints in X.509 certificate path processing. Specifically, when an end-entity certificate lacks a subject alternative name (SAN), Botan checked the common name (CN) against DNS name constraints in a case-sensitive manner, which is not required by RFC 5280. This allowed certificates with mixed-case CN values to bypass excludedSubtrees constraints, potentially permitting unauthorized certificates to be accepted. The vulnerability has been patched in Botan version 3.11.0.
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the `basicConstraints` and `keyUsage` extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid. Version 1.4.0 patches the issue.
Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.
Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Prior to version 0.13.0, code for client certificate verification did not check the key purpose as set in the Extended Key Usage extension. An attacker with access to the private key for a valid certificate issued by a CA trusted for TLS client authentication but designated for a different purpose could have used that certificate to improperly access resources requiring TLS client authentication. Server configurations that do not use client certificates (`GnuTLSClientVerify ignore`, the default) are not affected. The problem has been fixed in version 0.13.0 by rewriting certificate verification to use `gnutls_certificate_verify_peers()`, and requiring key purpose id-kp-clientAuth (also known as `tls_www_client` in GnuTLS) by default if the Extended Key Usage extension is present. The new `GnuTLSClientKeyPurpose` option allows overriding the expected key purpose if needed (please see the manual for details). Behavior for certificates without an Extended Key Usage extension is unchanged. If dedicated (sub-)CAs are used for issuing TLS client certificates only (not for any other purposes) the issue has no practical impact.
Improper certificate validation in the PAM propagation WinRM connections
allows a network attacker to perform a man-in-the-middle attack via
disabled TLS certificate verification.
Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6 and below do not safeguard against unauthenticated certificate issuance through the SCEP UpdateReq. This issue has been fixed in version 0.30.0.
Improper certificate validation in Devolutions Hub Reporting Service
2025.3.1.1 and earlier allows a network attacker to perform a
man-in-the-middle attack via disabled TLS certificate verification.
The GL-iNet Comet (GL-RM1) KVM connects to a GL-iNet site during boot-up to provision client and CA certificates. The GL-RM1 does not verify certificates used for this connection, allowing an attacker-in-the-middle to serve invalid client and CA certificates. The GL-RM1 will attempt to use the invalid certificates and fail to connect to the legitimate GL-iNet KVM cloud service.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2.
CVE-2026-2368 is a high-severity vulnerability in the Lenovo FileZ application caused by improper certificate validation (CWE-295). This flaw allows an attacker capable of intercepting network traffic to execute arbitrary code on affected systems. Exploitation requires the attacker to perform a man-in-the-middle (MitM) attack and involves user interaction but no authentication. The vulnerability impacts confidentiality, integrity, and availability due to the potential for remote code execution. No known exploits are currently in the wild, and no patches have been released yet. Organizations using Lenovo FileZ should be vigilant and implement network-level mitigations to reduce risk. Countries with significant Lenovo market presence and critical infrastructure reliance on this software are at higher risk. The CVSS 4.0 score is 7.5, indicating a high severity threat that demands prompt attention.
CVE-2026-1068 is a medium-severity vulnerability in Lenovo FileZ caused by improper certificate validation (CWE-295). This flaw allows an attacker capable of intercepting network traffic to access sensitive user data by exploiting the application's failure to correctly verify TLS/SSL certificates. The vulnerability does not require user interaction or authentication but does require the attacker to have network access to intercept communications. Although no known exploits are currently active in the wild, the risk lies primarily in man-in-the-middle (MitM) attacks that compromise confidentiality. Lenovo has not yet provided patches for affected versions. Organizations using Lenovo FileZ should monitor for updates and consider network-level protections to mitigate interception risks. Countries with significant Lenovo FileZ usage and high-value targets for espionage or cybercrime are most at risk. Due to the medium CVSS score and attack vector, this vulnerability warrants prompt attention but is not critical at this time.
Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to spoof the identity of a signer. Exploitation of this issue requires user interaction.