CVE-2026-78020

Improper Certificate Validation in Dell SCG Policy Manager Enables Remote Exploitation

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager

CVE-2022-1343

OCSP_basic_verify may incorrectly verify the response signing certificate

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Netapp Openssl Redhat

Products

A250 A250 Firmware A700s and 41 more

CVE-2021-28363

python-urllib3: HTTPS proxy host name not validated when using default SSLContext

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Fedoraproject Oracle Python and 1 more

Products

Fedora Peoplesoft Enterprise Peopletools Urllib3 and 1 more

CVE-2021-22926

curl: CURLOPT_SSLCERT mixup with Secure Transport

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

CVSS 3.1 · 7.5 High EPSS 15.1% KEV · Not listed

Vendors

Haxx Netapp Oracle and 2 more

Products

Curl Active Iq Unified Manager Clustered Data Ontap and 23 more

CVE-2021-22924

curl: Bad connection reuse due to flawed path name checks

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

CVSS 3.1 · 3.7 Low EPSS 6.3% KEV · Not listed

Vendors

Debian Fedoraproject Haxx and 5 more

Products

Debian Linux Fedora Libcurl and 52 more

CVE-2021-22897

curl: Cipher settings shared for all connections when using schannel TLS backed

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVSS 3.1 · 5.3 Medium EPSS 4.3% KEV · Not listed

Vendors

Haxx Netapp Oracle and 2 more

Products

Curl Cloud Backup H300e and 27 more

CVE-2020-8286

curl: Inferior OCSP verification

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 6 more

Products

Mac Os X Macos Debian Linux and 19 more

CVE-2026-54100

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture WICD and kubelet bootstrap credentials transferred during node configuration, enabling compromise of Windows node identities in the cluster.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform Openshift For Windows Containers and 2 more

CVE-2026-97687

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Python Urllib3

Products

Urllib3 Urllib3

CVE-2026-63697

Improper Certificate Validation in Dell System Update Allows Remote Code Execution

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

System Update

CVE-2026-109245

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2026-106584

openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-102671

Joyland AI WebView accepts invalid SSL certificates

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joyland

Products

Joyland.ai

CVE-2026-107318

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Fastify

Products

Fastify/reply-from

CVE-2026-107819

MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mariadb

Products

Server

CVE-2026-84032

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-105794

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

CVSS 4.0 · 9.1 Critical EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Msquic

CVE-2026-107587

Improper Certificate Validation in hMailServer

Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Progressive Robot

Products

Hmailserver

CVE-2021-44533

nodejs: Incorrect handling of certificate subject and issuer fields

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

CVSS 3.1 · 5.3 Medium EPSS 9.4% KEV · Not listed

Vendors

Debian Nodejs Oracle and 1 more

Products

Debian Linux Node.js Graalvm and 11 more

CVE-2021-3450

CA certificate check bypass with X509_V_FLAG_X509_STRICT

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

CVSS 3.1 · 7.4 High EPSS 18.3% KEV · Not listed

Vendors

Fedoraproject Freebsd Mcafee and 8 more

Products

Fedora Freebsd Web Gateway and 36 more