Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,874

Export CSV
CVE-2026-112165

Disabled TLS Certificate Validation Enables MITM Attacks

The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Laservideo
Products
Lasergest
CVE-2026-102476

Hostname Validation Bypass in Vert.x HTTP Client

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and obtain an SSL context with weaker properties, for instance a context with hostname validation and obtain a context ignoring hostname validation. The impacted component is io.vertx:vertx-core.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Eclipse Eclipse Foundation
Products
Vert.x Vert.x
CVE-2026-95761

Authenticated Improper Certificate Validation leads to Information Disclosure in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to obtain sensitive information.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-14375

The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Scale
CVE-2026-14435

IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by a vulnerability

IBM Turbonomic kubeturbo agent 8.16.0 through 8.20.3 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Turbonomic Kubeturbo Agent
CVE-2026-96453

Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates

A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Build Keycloak Jboss Enterprise Application Platform and 4 more
CVE-2026-95764

Unauthenticated Adjacent Improper Certificate Validation in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-95763

Unauthenticated Improper Certificate Validation allows Information Disclosure in HPE Networking Fabric Composer

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept transferred files and the stored credentials for remote servers.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-61813

ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Modsecurity
Products
Modsecurity
CVE-2026-54372

VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. Attackers can perform a man-in-the-middle attack to capture account sessions and health-related API data, and use a captured session to delete the account's authentication record and prevent legitimate login.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Shenzhen Shine Industrial
Products
Vitafit
CVE-2026-95736

Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer

Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-14434

IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerability

IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Turbonomic Kubeturbo Agent
CVE-2026-95755

Unauthenticated Adjacent Improper Certificate Validation allows Interception of Management Traffic in HPE Networking Fabric Composer

Improper certificate validation vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept management traffic if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-17333

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17308

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-95751

Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric Composer

An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-95750

Unauthenticated Improper Certificate Validation in HPE Networking Fabric Composer

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-95740

Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer

An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer
CVE-2026-95735

Improper Certificate Validation in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Fabric Composer Fabric Composer