# CWE-599.

Every Advisory and CVE whose sources give the weakness CWE-599, newest first.

## Records, newest first

- [Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models](https://agentprime.io/advisories/CVE-2026-62657.md)
  `CVE-2026-62657` · CVE record: NETGEAR MR70 and 3 more · CVSS 4.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-599
- [SageMaker Python SDK has Insecure TLS Configuration](https://agentprime.io/advisories/GHSA-62rc-f4v9-h543.md)
  `GHSA-62rc-f4v9-h543`, `CVE-2026-1778`, `PYSEC-2026-1886` · PyPI `sagemaker`: affected `<2.256.0 || >=3.0, <3.1.1`, fixed in `2.256.0`, `3.1.1` · CVSS 8.2 High · Not analysed yet · Published 2 Feb 2026 · Tags: Weak cryptography or TLS, CWE-599
- [OpenList has Insecure TLS Default Configuration](https://agentprime.io/advisories/GHSA-wf93-3ghh-h389.md)
  `GHSA-wf93-3ghh-h389`, `CVE-2026-25060`, `GO-2026-4397` · Go `github.com/OpenListTeam/OpenList/v4`: affected `<4.1.10`, fixed in `4.1.10` · CVSS 8.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-599
- [Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation.](https://agentprime.io/advisories/CVE-2025-63432.md)
  `CVE-2025-63432` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: CWE-599
- [GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation.](https://agentprime.io/advisories/CVE-2025-56232.md)
  `CVE-2025-56232` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-599
- [Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.](https://agentprime.io/advisories/CVE-2025-56230.md)
  `CVE-2025-56230` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2025 · Tags: CWE-599
- [Server Certificate Verification Disabled](https://agentprime.io/advisories/CVE-2025-12553.md)
  `CVE-2025-12553` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-599
- [Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity.](https://agentprime.io/advisories/CVE-2025-56146.md)
  `CVE-2025-56146` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: CWE-599
- [Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd](https://agentprime.io/advisories/GHSA-7943-82jg-wmw5.md)
  `GHSA-7943-82jg-wmw5`, `CVE-2022-31105`, `GO-2022-0518` · Go `github.com/argoproj/argo-cd` and 1 more: affected `>=0.4.0`, no fixed version yet · CVSS 8.3 High · Not analysed yet · Published 21 Aug 2024 · Tags: Weak cryptography or TLS, CWE-599
- [cortex establishes TLS connections with \`InsecureSkipVerify\` set to \`true\` in github.com/cortexproject/cortex](https://agentprime.io/advisories/GHSA-vw7g-3cc7-7rmh.md)
  `GHSA-vw7g-3cc7-7rmh`, `CVE-2024-41265`, `GO-2024-3036` · Go `github.com/cortexlabs/cortex`: affected `*`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-599
- [Beego privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-r6qh-j42j-pw64.md)
  `GHSA-r6qh-j42j-pw64`, `CVE-2024-40464`, `GO-2024-3016` · Go `github.com/beego/beego/v2`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2024 · Tags: Weak cryptography or TLS, CWE-599
- [goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.](https://agentprime.io/advisories/CVE-2024-41253.md)
  `CVE-2024-41253` · CVE record · CVSS 7.1 High · Not analysed yet · Published 31 Jul 2024 · Tags: CWE-599
- [D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL.](https://agentprime.io/advisories/CVE-2024-36755.md)
  `CVE-2024-36755` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 27 Jun 2024 · Tags: CWE-599
- [HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack](https://agentprime.io/advisories/GHSA-8r96-8889-qg2x.md)
  `GHSA-8r96-8889-qg2x`, `CVE-2023-48052`, `PYSEC-2023-242` · PyPI `httpie`: affected `<3.2.3`, fixed in `3.2.3` · CVSS 7.4 High · Not analysed yet · Published 16 Nov 2023 · Tags: Weak cryptography or TLS, CWE-599
- [Nimble fails to validate certificates due to insecure httpClient defaults](https://agentprime.io/advisories/CVE-2021-21374.md)
  `CVE-2021-21374` · CVE record: nim-lang security · CVSS 8.1 High · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-348, CWE-349, CWE-599

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-599>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-599/>. Everything for agents: <https://agentprime.io/llms.txt>.