Filtered by CWE-295
Filtered by vendor Subscriptions
Total 1395 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-15323 1 Tanium 1 Tanos 2026-02-10 3.7 Low
Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.
CVE-2025-71063 1 Mrvladus 1 Errands 2026-02-05 8.2 High
Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.
CVE-2025-39205 1 Hitachienergy 1 Microscada X Sys600 2026-01-30 6.5 Medium
A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation.
CVE-2025-67229 1 Todesktop 1 Builder 2026-01-29 9.8 Critical
An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.
CVE-2025-58188 1 Golang 2 Crypto, Go 2026-01-29 7.5 High
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
CVE-2025-13052 1 Asustor 2 Adm, Data Master 2026-01-28 5.9 Medium
When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle (MITM) attack, which may obtain the sensitive information of the SMTP. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RKD2 as well as from ADM 5.0.0 through ADM 5.1.0.RN42.
CVE-2025-30024 1 Axis 1 Device Manager 2026-01-24 6.8 Medium
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack.
CVE-2024-50394 1 Qnap 1 Helpdesk 2026-01-22 8.8 High
An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: Helpdesk 3.3.3 and later
CVE-2025-46070 1 Automai 1 Botmanager 2026-01-22 9.8 Critical
An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component
CVE-2025-13034 2 Curl, Haxx 2 Curl, Curl 2026-01-20 5.9 Medium
When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
CVE-2025-14819 2 Curl, Haxx 2 Curl, Curl 2026-01-20 5.3 Medium
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not.
CVE-2024-31884 2026-01-20 6.5 Medium
No description is available for this CVE.
CVE-2025-52598 1 Hanwhavision 512 Knb-2000, Knb-2000 Firmware, Knb-5000n and 509 more 2026-01-16 3.7 Low
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camera's client service does not perform certificate validation. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVE-2025-65291 1 Aqara 6 Camera Hub G3, Camera Hub G3 Firmware, Hub M2 and 3 more 2026-01-15 7.4 High
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
CVE-2023-29175 1 Fortinet 2 Fortios, Fortiproxy 2026-01-14 4.4 Medium
An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's map server.
CVE-2023-47537 1 Fortinet 1 Fortios 2026-01-14 4.4 Medium
An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.
CVE-2025-30669 1 Zoom 7 Meeting Software Development Kit, Workplace, Workplace App and 4 more 2026-01-13 4.8 Medium
Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.
CVE-2024-30149 1 Hcltech 1 Appscan Source 2026-01-08 4.8 Medium
HCL AppScan Source <= 10.6.0 does not properly validate a TLS/SSL certificate for an executable.
CVE-2025-56231 1 Tonec 1 Internet Download Manager 2026-01-07 9.1 Critical
Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.
CVE-2025-14022 2 Apple, Linecorp 2 Ios, Line 2026-01-07 7.7 High
LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.