CVE-2026-113812 is a critical vulnerability in Mozilla::CA versions before 20261020 for Perl. The CA certificate bundle includes the "emSign ECC Root CA - G3" root, which trusts intermediate certificates with publicly compromised private keys. This flaw allows an attacker who can intercept or redirect client traffic to impersonate TLS servers. Clients using IO::Socket::SSL may fall back to this vulnerable CA bundle depending on configuration. Users should verify their CA store and apply vendor updates if relying on the system store.
CVE-2026-87866 is a critical vulnerability in curl when built with wolfSSL, involving improper certificate validation. During the TLS handshake, wolfSSL validates the connection correctly, but curl's re-parsing of the certificate can be tricked by a manipulated validity length field to extract and match a different embedded key. This flaw allows curl to incorrectly authorize a pinned public key hash against a key the TLS peer does not possess, undermining the security of TLS connections.
CVE-2026-87865 is a vulnerability in curl's libcurl component when used with libssh2 and a hashed known_hosts file. An unrelated initial entry in the known_hosts file can cause the host key validation to incorrectly report a key mismatch as a missing key to the CURLOPT_SSH_KEYFUNCTION callback. This improper certificate validation can lead to potential security risks during SSH host key verification.
IBM Concert versions 1.0 through 3.0.0 contain a vulnerability related to improper certificate validation. This flaw could allow an attacker to bypass certain security checks related to certificate authenticity. The vulnerability has a low severity rating with limited impact on confidentiality and integrity, and no impact on availability.
Improper Certificate Validation vulnerability in Apache Camel Knative component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
When SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate rather than to the JVM's default trust anchors. A deployment that switched TLS on without also configuring a truststore therefore obtained an encrypted connection with no peer authentication, which an attacker positioned on the network path can terminate and read. The dangerous state is reached by omission rather than by an explicit opt-in, which is what makes it a framework defect: turning TLS on should not be the thing that turns certificate validation off.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. With no truststore configured the trust options are now left unset so the JVM default trust anchors apply, the same fallback SSLContextParameters and the rest of Camel use. Trusting every certificate is now reached only by asking for it explicitly through the trust.all property, which remains available for development against a cluster with a self-signed certificate. For deployments that cannot upgrade immediately, configure a truststore explicitly wherever SSL is enabled. After upgrading, a deployment that was relying on the implicit trust-all behaviour must either configure a truststore or set the trust.all property deliberately.
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
CVE-2025-23390 is a medium severity vulnerability in SUSE Fleet where the software improperly validates SSH server certificates by automatically trusting certificates not present in the known_hosts file. This flaw could allow a man-in-the-middle (MitM) attack if the server's certificate is not pre-registered. When the server's certificate is in the known_hosts file, Fleet correctly verifies authenticity. The vulnerability affects multiple Fleet versions prior to 0.10.12, 0.11.7, and 0.12.2.
CVE-2026-19377 is a medium severity vulnerability in Cato Networks Cato Client for Windows involving improper certificate validation during the tunnel handshake. This flaw allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic. The vulnerability affects multiple versions prior to 6.12.6, 6.1.1, 5.8.1, 5.9, and 5.6.2. No patch or remediation information is provided in the available data.
CVE-2026-105236 is an improper certificate validation vulnerability in the ssl application of Erlang/OTP. It allows a client trusted by one SNI virtual host to authenticate to another SNI virtual host on the same listener by resuming a TLS 1.2 session. The issue arises because the server's session cache is shared across SNI names without binding sessions to specific SNI names or client trust policies. This affects Erlang/OTP versions from 18.0 up to but not including 27.3.4.19 and ssl versions from 7.0 up to but not including 11.2.12.14. TLS 1.3 is not affected. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity).
CVE-2026-91881 is a critical vulnerability in Dell Terraform Provider for Redfish versions prior to 1.6.2. It involves improper certificate validation in the HTTP transport component, where TLS certificate verification is disabled unconditionally. This flaw allows an unauthenticated remote attacker to perform man-in-the-middle attacks, intercepting all Redfish BMC traffic including credentials. Dell recommends upgrading to a fixed version to mitigate this issue.
CVE-2026-103294 is an improper certificate validation vulnerability in Adobe Content Credentials Rust SDK. This flaw could allow an attacker to bypass security features and gain unauthorized write access without requiring user interaction. Exploitation depends on conditions outside the attacker's control. The vulnerability has a medium severity rating with a CVSS score of 5.9.
CVE-2026-100116 is an improper certificate validation vulnerability in Adobe Content Credentials Rust SDK. This flaw allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction. Exploitation depends on conditions beyond the attacker's control. The vulnerability has a medium severity with a CVSS score of 5.9.
CVE-2026-100123 is an improper certificate validation vulnerability in Adobe Content Credentials Rust SDK that allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction. The vulnerability is rated high severity with a CVSS score of 7.5.
CVE-2026-100122 is an Improper Certificate Validation vulnerability in Adobe Content Credentials Rust SDK that allows an attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability has a high severity score of 7.5 and does not impact confidentiality or availability but compromises integrity.
CVE-2026-100121 is an improper certificate validation vulnerability in Adobe Content Credentials Rust SDK. This flaw allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction. The vulnerability is rated high severity with a CVSS score of 7.5. No patch or remediation details are currently provided by the vendor.
CVE-2026-100118 is an improper certificate validation vulnerability in Adobe Content Credentials Rust SDK. This flaw allows an attacker to bypass security features and gain unauthorized write access without requiring user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-77816 is a vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. It involves improper certificate validation in the administrative client, which could allow a man-in-the-middle attacker to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-108131 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper certificate validation in Active Directory Federation Services (AD FS). This flaw allows an unauthorized attacker to perform network spoofing. The issue is addressed by official patches released by Microsoft.
CVE-2026-96222 is a high-severity vulnerability in Microsoft .NET Framework 3.5 involving improper certificate validation in Active Directory Federation Services (AD FS). This flaw allows an unauthorized attacker to perform network spoofing attacks. The vulnerability affects multiple specific versions of the .NET Framework and related components. Microsoft has issued official fixes for the affected versions to address this issue.
CVE-2026-70194 is a vulnerability in Microsoft .NET 11.0 runtime involving improper certificate validation. This flaw allows an unauthorized attacker to bypass a security feature over a network. The issue affects specific versions of the .NET runtime prior to official fixes. A patch is available and has been officially released by Microsoft.