# CWE-299.

Every Advisory and CVE whose sources give the weakness CWE-299, newest first.

## Records, newest first

- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3…](https://agentprime.io/advisories/CVE-2026-118696.md)
  `CVE-2026-118696` · CVE record: JetBrains IntelliJ IDEA and 4 more · CVSS 8.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-299
- [Distrust compromised intermediate certificates in ssl module](https://agentprime.io/advisories/CVE-2026-115557.md)
  `CVE-2026-115557` · CVE record: Python Software Foundation CPython · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: CWE-299
- [Electron: Mitigation for compromised eMudhra intermediate certificates](https://agentprime.io/advisories/GHSA-jr5w-w6x2-84p9.md)
  `GHSA-jr5w-w6x2-84p9`, `CVE-2026-115570` · npm `electron`: affected `<42.11.16 || >=43.0.0-alpha.1, <43.8.1 || >=44.0.0-alpha.1, <44.9.1 || >=45.0.0-alpha.1, <45.0.0-beta.6`, fixed in `42.11.16`, `43.8.1`, `44.9.1`, `45.0.0-beta.6` · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-299
- [Distrust compromised intermediate certificates in crypto/x509](https://agentprime.io/advisories/GO-2026-6809.md)
  `GO-2026-6809`, `BIT-golang-2026-111943`, `CVE-2026-111943`, `RUSTSEC-2026-0381`, `RUSTSEC-2026-0382`, `RUSTSEC-2026-0383` · Go `stdlib`: affected `<1.26.10 || >=1.27.0-0, <1.27.3`, fixed in `1.26.10`, `1.27.3` · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-299
- [Secure Boot Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-102221.md)
  `CVE-2026-102221` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-299
- [CRL check skipped when OCSP enabled and certificate has no OCSP URL](https://agentprime.io/advisories/CVE-2026-94417.md)
  `CVE-2026-94417` · CVE record: wolfSSL wolfSSL · CVSS 2.3 Low · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-299
- [Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore](https://agentprime.io/advisories/CVE-2026-73581.md)
  `CVE-2026-73581` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-299
- [Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field](https://agentprime.io/advisories/CVE-2026-93493.md)
  `CVE-2026-93493` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-299
- [mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation](https://agentprime.io/advisories/CVE-2026-86231.md)
  `CVE-2026-86231` · CVE record: mwiede jsch · CVSS 6.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-298, CWE-299
- [Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator](https://agentprime.io/advisories/GHSA-g7hg-vrcf-mvmr.md)
  `GHSA-g7hg-vrcf-mvmr`, `CVE-2026-56821` · Maven `io.netty:netty-handler-ssl-ocsp`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.4 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-299
- [nebula-mesh: Certificate revocation is never enforced at the mesh](https://agentprime.io/advisories/GHSA-cm26-5974-52h8.md)
  `GHSA-cm26-5974-52h8`, `CVE-2026-61699`, `GO-2026-5986` · Go `github.com/forgekeep/nebula-mesh`: affected `<0.7.1`, fixed in `0.7.1` · CVSS 8.1 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-299, CWE-672
- [Rockwell Automation CompactLogix® 5380 ControlLogix® 5580 / 1756-EN4 Communications Module – Certificate Revocation List Vulnerability](https://agentprime.io/advisories/CVE-2026-9636.md)
  `CVE-2026-9636` · CVE record: Rockwell Automation ControlLogix® 5580, CompactLogix® 5380, GuardLogix® 5580, Compact GuardLogix® 5380, 1756-EN4TR · CVSS 8.2 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-299
- [Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks](https://agentprime.io/advisories/GHSA-8f6j-263m-g72x.md)
  `GHSA-8f6j-263m-g72x` · PyPI `app-store-server-library`: affected `>=0.2.0, <3.1.2`, fixed in `3.1.2` · CVSS 4.0, no score published · Not analysed yet · Published 13 Jul 2026 · Tags: Weak cryptography or TLS, CWE-299
- [Improper Check for Certificate Revocation in S2OPC](https://agentprime.io/advisories/CVE-2026-6899.md)
  `CVE-2026-6899` · CVE record: Systerel S2OPC · CVSS 5.6 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-299
- [sequoia-git has broken hard revocation handling](https://agentprime.io/advisories/GHSA-g27r-r6ph-vf5r.md)
  `GHSA-g27r-r6ph-vf5r`, `RUSTSEC-2026-0109` · crates.io `sequoia-git`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 4 May 2026 · Tags: CWE-299
- [CRL Distribution Point Scope Check Logic Error in AWS-LC](https://agentprime.io/advisories/GHSA-9f94-5g5w-gf6r.md)
  `GHSA-9f94-5g5w-gf6r`, `CVE-2026-4428`, `RUSTSEC-2026-0042`, `RUSTSEC-2026-0048` · crates.io `aws-lc-fips-sys` and 1 more: affected `>=0.13.0, <0.13.13`, fixed in `0.13.13` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Weak cryptography or TLS, CWE-299
- [CRLs not considered authoritative by Distribution Point due to faulty matching logic](https://agentprime.io/advisories/GHSA-pwjx-qhcg-rvj4.md)
  `GHSA-pwjx-qhcg-rvj4`, `CVE-2026-93602`, `RUSTSEC-2026-0049` · crates.io `rustls-webpki`: affected `>=0.102.0-alpha.0, <0.103.10`, fixed in `0.103.10` · CVSS 5.9 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-299
- [Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise](https://agentprime.io/advisories/CVE-2025-11955.md)
  `CVE-2025-11955` · CVE record: TheGreenBow TheGreenBow VPN Client Windows Enterprise · CVSS 8.2 High · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-299
- [IBM Cognos Analytics Mobile (iOS) authentication bypass](https://agentprime.io/advisories/CVE-2025-36057.md)
  `CVE-2025-36057` · CVE record: IBM Cognos Analytics Mobile · CVSS 5.2 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-299
- [MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked](https://agentprime.io/advisories/CVE-2025-3085.md)
  `CVE-2025-3085` · CVE record: MongoDB Inc MongoDB Server · CVSS 8.1 High · Not analysed yet · Published 1 Apr 2025 · Tags: CWE-299
- [notation-go's timestamp signature generation lacks certificate revocation check](https://agentprime.io/advisories/GHSA-45v3-38pc-874v.md)
  `GHSA-45v3-38pc-874v`, `CVE-2024-56138`, `GO-2025-3381` · Go `github.com/notaryproject/notation-go`: affected `>=1.2.0-beta.1, <1.3.0-rc.2`, fixed in `1.3.0-rc.2` · CVSS 4.0 Medium · Not analysed yet · Published 13 Jan 2025 · Tags: CWE-299
- [Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability.](https://agentprime.io/advisories/CVE-2023-23690.md)
  `CVE-2023-23690` · CVE record: Dell Cloud Mobility for Dell Storage · CVSS 7.0 High · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-299
- [Juniper Networks Mist Cloud UI: SAML authentication certificate vulnerability.](https://agentprime.io/advisories/CVE-2020-1675.md)
  `CVE-2020-1675` · CVE record: Juniper Networks MIST Cloud UI · CVSS 8.3 High · Not analysed yet · Published 16 Oct 2020 · Tags: CWE-299
- [Philips Patient Monitoring Devices Improper Check for Certificate Revocation](https://agentprime.io/advisories/CVE-2020-16228.md)
  `CVE-2020-16228` · CVE record: Philips Patient Information Center iX (PICiX) and 3 more · No CVSS score · Not analysed yet · Published 11 Sept 2020 · Tags: CWE-299

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-299>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-299/>. Everything for agents: <https://agentprime.io/llms.txt>.