EUVD-2026-70743

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2026-9036

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 contain a TLS certificate validation flaw where the software does not validate or improperly validates TLS certificates. This allows a network-based attacker to perform a man-in-the-middle attack to obtain sensitive information , with...

CVE-2026-84736

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...

DEBIAN-CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

UBUNTU-CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

CVE-2026-84736

Eclipse aeriOS (current development version, no official release published) has a vulnerability in its Federator component where TLS certificate validation is disabled by default for outbound HTTPS connections. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the...

CVE-2026-85221

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2026-84964 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

EUVD-2026-70514

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

CVE-2026-82180

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...

EUVD-2026-70494

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2026-85221

MISP 's CurlClient component contained an improper TLS certificate validation flaw: the CurlClient::$verifyPeer property was not explicitly initialized and defaulted to null, effectively disabling TLS peer verification in cURL unless calling code explicitly re-enabled it. An attacker positioned t...

CVE-2026-85221 MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly...

CVE-2026-82180

Eclipse Arrowhead versions 5.0.0 through 5.2.1 are affected when the MQTT API is enabled with the certificate authentication policy. The CertificateMqttFilter decodes an X.509 certificate from the MQTT message payload using CertificateFactory.generateCertificate() but never verifies its signature...

EUVD-2026-70467

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...

CVE-2026-85175

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

RLSA-2026:62578 Important: go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location...