CVE-2026-34580

A flaw was found in Botan, a C++ cryptography library. Due to a misleading function name and an assumption in path validation logic, an end entity certificate could be incorrectly accepted as a trusted root. This occurs when the end entity certificate's Distinguished Name DN and Subject Key...

CVE-2026-32144

Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeyocsp module allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in publickey:pkixocspvalidate/5 does not verify that a CA-designated responder certificate...

SUSE CVE-2017-18911

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server...

Vulnerabilities fixed in Adobe Acrobat Reader

Adobe has fixed vulnerabilities in Adobe Acrobat Reader versions up to 25.001.21265. The vulnerabilities include a Use After Free vulnerability that can be exploited to achieve arbitrary code execution. This vulnerability is triggered when a user opens a maliciously crafted file. In addition, the...

Linux Distros Unpatched Vulnerability : CVE-2026-3336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects...

AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

Summary AWS-LC is an open-source, general-purpose cryptographic library. Impact Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers ...

GHSA-VW5V-4F2Q-W9XF AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

Summary AWS-LC is an open-source, general-purpose cryptographic library. Impact Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers ...

CVE-2026-3336

Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should...

CVE-2026-3336 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Improper certificate validation in PKCS7verify in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should...

CLSA-2026-1772124479 golang: Fix of 7 CVEs

Update to Go 1.25.7 - CVE-2025-61726: fixed DoS due to memory exhaustion flaw in net/url parameter parsing - CVE-2025-61732: fixed RCE via code smuggling flaw in cgo comment parsing - CVE-2025-68121: fixed security bypass in TLS where session resumption could ignore revoked or expired client...

USN-8045-1 ceph vulnerabilities

Martin Schobert discovered that Ceph did not properly verify SSL certificates when using Pybind for secure mail connections, which could result in accepting invalid certificates. An attacker could possibly use this issue to perform an intermediary attack and access mail server credentials or...

yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests...

GHSA-663H-2VR3-GHRJ yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests...

CVE-2025-70043

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options...

CVE-2026-25961

SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification INTERNETFLAGIGNORECERTCNINVALID and executes installers without signature checks. A network attacker with any valid TLS certificate e.g., Let's Encrypt can...

Improper TLS Certificate Validation

SageMaker is vulnerable to Improper TLS Certificate Validation. The vulnerability is due to TLS certificate verification being disabled when importing Triton Python models, allowing HTTPS connections with invalid or self-signed certificates to succeed, which exposes applications to...

MiracleLinux 9 : qt5-5.15.9-1.el9 (AXSA:2023-6891:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6891:08 advisory. qt: buffer over-read via a crafted reply from a DNS server CVE-2023-33285 qt: allows remote attacker to bypass security restrictions caused by flaw ...

MiracleLinux 8 : dotnet7.0-7.0.115-1.el8_9.ML.1 (AXSA:2024-7407:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7407:02 advisory. dotnet: Information Disclosure: MD.SqlClientMDS & System.data.SQLClient SDS CVE-2024-0056 dotnet: X509 Certificates - Validation Bypass across Azure...

MiracleLinux 9 : dotnet6.0-6.0.126-1.el9_3.ML.1 (AXSA:2024-7413:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7413:03 advisory. dotnet: Information Disclosure: MD.SqlClientMDS & System.data.SQLClient SDS CVE-2024-0056 dotnet: X509 Certificates - Validation Bypass across Azure...

MiracleLinux 8 : qt5-qtbase-5.15.3-5.el8 (AXSA:2023-7239:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7239:02 advisory. qt: buffer over-read via a crafted reply from a DNS server CVE-2023-33285 qt: allows remote attacker to bypass security restrictions caused by flaw ...