# CWE-296. Every Advisory and CVE whose sources give the weakness CWE-296, newest first. ## Records, newest first - [s2s-proxy accepts untrusted client certificates](https://agentprime.io/advisories/CVE-2026-96770.md) `CVE-2026-96770` · CVE record: Temporal Technologies, Inc. s2s-proxy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-296 - [SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor](https://agentprime.io/advisories/GHSA-6hxq-p678-4hr2.md) `GHSA-6hxq-p678-4hr2` · npm `@simplewebauthn/server`: affected `<13.3.2`, fixed in `13.3.2` · CVSS 4.0, no score published · Not analysed yet · Published 4 Sept 2026 · Tags: Weak cryptography or TLS, CWE-296 - [Multiple SEIKO EPSON printers and scanners contain revoked root certificates.](https://agentprime.io/advisories/CVE-2026-73542.md) `CVE-2026-73542` · CVE record: SEIKO EPSON CORPORATION Multiple SEIKO EPSON printers and scanners · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-296 - [Slate Digital Connect macOS XPC certificate validation privilege escalation](https://agentprime.io/advisories/CVE-2026-24066.md) `CVE-2026-24066` · CVE record: Slate Digital LLC Slate Digital Connect · CVSS 8.4 High · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-296 - [Non-CA certificate accepted as intermediate issuer in public_key path validation](https://agentprime.io/advisories/CVE-2026-42789.md) `CVE-2026-42789` · CVE record: Erlang OTP · CVSS 7.0 High · Not analysed yet · Published 27 May 2026 · Tags: Weak cryptography or TLS, CWE-296 - [Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-44852.md) `CVE-2026-44852` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-296 - [Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App](https://agentprime.io/advisories/CVE-2025-10539.md) `CVE-2025-10539` · CVE record: DeskTime DeskTime Time Tracking App · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Weak cryptography or TLS, CWE-296, CWE-494 - [Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication](https://agentprime.io/advisories/CVE-2026-33779.md) `CVE-2026-33779` · CVE record: Juniper Networks Junos OS · CVSS 8.3 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-296 - [Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster](https://agentprime.io/advisories/GHSA-gvrj-cjch-728p.md) `GHSA-gvrj-cjch-728p`, `CVE-2026-4370`, `GO-2026-5405` · Go `github.com/juju/juju`: affected `<=0.0.0-20260401092550-1c1ac1922b57`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-296 - [Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication](https://agentprime.io/advisories/CVE-2026-27134.md) `CVE-2026-27134` · CVE record: strimzi strimzi-kafka-operator · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-296 - [Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters](https://agentprime.io/advisories/CVE-2026-27133.md) `CVE-2026-27133` · CVE record: strimzi strimzi-kafka-operator · CVSS 5.9 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: Weak cryptography or TLS, CWE-296 - [OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs](https://agentprime.io/advisories/GHSA-mjcp-gpgx-ggcg.md) `GHSA-mjcp-gpgx-ggcg`, `GO-2025-4224` · Go `github.com/opentofu/opentofu`: affected `<1.10.8`, fixed in `1.10.8` · CVSS 5.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-296, CWE-1395 - [Eclipse Jersey has a Race Condition](https://agentprime.io/advisories/GHSA-7p63-w6x9-6gr7.md) `GHSA-7p63-w6x9-6gr7`, `CVE-2025-12383` · Maven `org.glassfish.jersey.core:jersey-client`: affected `>=2.45, <2.46 || >=3.0.16, <3.0.17 || >=3.1.9, <3.1.10`, fixed in `2.46`, `3.0.17`, `3.1.10` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2025 · Tags: Race condition, CWE-296 - [Icinga 2 certificate renewal might incorrectly renew an invalid certificate](https://agentprime.io/advisories/CVE-2025-48057.md) `CVE-2025-48057` · CVE record: Icinga icinga2 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2025 · Tags: CWE-296 - [Ivanti Endpoint Manager: Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or…](https://agentprime.io/advisories/CVE-2025-22459.md) `CVE-2025-22459` · CVE record: Ivanti Endpoint Manager · CVSS 4.8 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-296 - [IBM OpenPages data manipulation](https://agentprime.io/advisories/CVE-2024-43196.md) `CVE-2024-43196` · CVE record: IBM OpenPages with Watson · CVSS 4.3 Medium · Not analysed yet · Published 20 Feb 2025 · Tags: CWE-296 - [CrowdStrike Falcon Sensor for Linux TLS Issue](https://agentprime.io/advisories/CVE-2025-1146.md) `CVE-2025-1146` · CVE record: CrowdStrike Falcon sensor for Linux and 2 more · CVSS 8.1 High · Not analysed yet · Published 12 Feb 2025 · Tags: CWE-296 - [Node: Node.js < 12.22.9, < 14.18.3, < 16.13.2…](https://agentprime.io/advisories/CVE-2021-44532.md) `CVE-2021-44532` · CVE record: NodeJS Node · No CVSS score · EPSS 0.10 · Not analysed yet · Published 24 Feb 2022 · Tags: CWE-296 - [Gallagher Command Centre Mobile Connect for Android: Improper validation of the cloud certificate chain in Mobile Connect allows…](https://agentprime.io/advisories/CVE-2021-23162.md) `CVE-2021-23162` · CVE record: Gallagher Command Centre Mobile Connect for Android · CVSS 7.7 High · Not analysed yet · Published 18 Nov 2021 · Tags: CWE-296 - [Gallagher Command Centre Mobile Client for Android: Improper validation of the cloud certificate chain in Mobile Client allows…](https://agentprime.io/advisories/CVE-2021-23155.md) `CVE-2021-23155` · CVE record: Gallagher Command Centre Mobile Client for Android · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2021 · Tags: CWE-296 - [Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability](https://agentprime.io/advisories/CVE-2021-1566.md) `CVE-2021-1566` · CVE record: Cisco Cisco Web Security Appliance (WSA) · CVSS 7.4 High · Not analysed yet · Published 16 Jun 2021 · Tags: CWE-296 - [Dell Data Protection Central: Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2…](https://agentprime.io/advisories/CVE-2019-3762.md) `CVE-2019-3762` · CVE record: Dell Data Protection Central · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2020 · Tags: CWE-296 - [Improper certificate validation in The Gnome Project evolution-ews](https://agentprime.io/advisories/CVE-2019-3890.md) `CVE-2019-3890` · CVE record: The Gnome Project evolution-ews · CVSS 8.1 High · Not analysed yet · Published 1 Aug 2019 · Tags: Weak cryptography or TLS, CWE-296 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .