Advisories · Weakness
CWE-296.
Every Advisory and CVE whose sources give the weakness CWE-296, newest first.
- CVSS 9.3 CriticalCritical · CVSS 9+
s2s-proxy accepts untrusted client certificates
- Temporal Technologies, Inc. s2s-proxy
- CWE-296
- CVSS 4.0, no score published
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
- Weak cryptography or TLS
- CWE-296
<13.3.2 · fixed in 13.3.2
GHSA-6hxq-p678-4hr2 - CVSS 6.3 Medium
Multiple SEIKO EPSON printers and scanners contain revoked root certificates.
- SEIKO EPSON CORPORATION Multiple SEIKO EPSON printers and scanners
- CWE-296
- CVSS 8.4 High
Slate Digital Connect macOS XPC certificate validation privilege escalation
- Slate Digital LLC Slate Digital Connect
- CWE-296
- CVSS 7.0 High
Non-CA certificate accepted as intermediate issuer in public_key path validation
- Erlang OTP
- Weak cryptography or TLS
- CWE-296
- CVSS 7.2 High
Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- CWE-296
- CVSS 4.8 Medium
Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App
- DeskTime Time Tracking App
- Weak cryptography or TLS
- CWE-296
- CVSS 8.3 High
Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication
- Juniper Networks Junos OS
- CWE-296
- CVSS 10.0 CriticalCritical · CVSS 9+
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster
- Authentication bypass
- Weak cryptography or TLS
<=0.0.0-20260401092550-1c1ac1922b57 · no fixed version yet
GHSA-gvrj-cjch-728p · CVE-2026-4370 - CVSS 8.1 High
Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication
- strimzi-kafka-operator
- Authentication bypass
- Weak cryptography or TLS
- CVSS 5.9 Medium
Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters
- strimzi-kafka-operator
- Weak cryptography or TLS
- CWE-296
- CVSS 5.9 Medium
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs
- CWE-296
- CWE-1395
<1.10.8 · fixed in 1.10.8
GHSA-mjcp-gpgx-ggcg - CVSS 9.4 CriticalCritical · CVSS 9+
Eclipse Jersey has a Race Condition
- Race condition
- CWE-296
>=2.45, <2.46 || >=3.0.16, <3.0.17 || >=3.1.9, <3.1.10 · fixed in 2.46, 3.0.17, 3.1.10
GHSA-7p63-w6x9-6gr7 · CVE-2025-12383 - CVSS 9.3 CriticalCritical · CVSS 9+
Icinga 2 certificate renewal might incorrectly renew an invalid certificate
- icinga2
- CWE-296
- CVSS 4.8 Medium
Ivanti Endpoint Manager: Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or…
- Ivanti Endpoint Manager
- CWE-296
- CVSS 4.3 Medium
IBM OpenPages data manipulation
- IBM OpenPages with Watson
- CWE-296
- CVSS 8.1 High
CrowdStrike Falcon Sensor for Linux TLS Issue
- CrowdStrike Falcon sensor for Linux
- CrowdStrike Falcon Kubernetes Admission Controller
- CWE-296
-
Node: Node.js < 12.22.9, < 14.18.3, < 16.13.2…
- Node
- CWE-296
- CVSS 7.7 High
Gallagher Command Centre Mobile Connect for Android: Improper validation of the cloud certificate chain in Mobile Connect allows…
- Gallagher Command Centre Mobile Connect for Android
- CWE-296
- CVSS 9.0 CriticalCritical · CVSS 9+
Gallagher Command Centre Mobile Client for Android: Improper validation of the cloud certificate chain in Mobile Client allows…
- Gallagher Command Centre Mobile Client for Android
- CWE-296
- CVSS 7.4 High
Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability
- Cisco Web Security Appliance (WSA)
- CWE-296
- CVSS 7.5 High
Dell Data Protection Central: Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2…
- Dell Data Protection Central
- CWE-296
- CVSS 8.1 High
Improper certificate validation in The Gnome Project evolution-ews
- The Gnome Project evolution-ews
- Weak cryptography or TLS
- CWE-296