Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes...
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScri
#cwe-295
共收录 447 条相关情报。
← 返回所有主题Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in...
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScri
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
## Summary `validateCertificatePath()` does not verify that an attestation's certificate chain actually terminates at a
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent f...
CVE-2026-84961
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and re
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were n...
CVE-2026-85525
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certifica
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agen...
CVE-2026-15937
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse e
Improper OCSP response validation in Snowflake drivers
CVE-2026-85525
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certifica
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates...
CVE-2026-9036
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validati
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive inf...
CVE-2026-9036
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validati
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbo...
CVE-2026-84736
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federato
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to ...
CVE-2026-85221
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property w
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that...
CVE-2026-82180
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication polic
MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
CVE-2026-85221
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property w
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disable_jwk_s...
CVE-2026-82955
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance in
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Att...
CVE-2026-82662
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, a
Nodemailer before 8.0.8 TLS Certificate Validation Bypass
CVE-2026-82662
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, a
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned...
CVE-2026-41012
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vC
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture adminis...
CVE-2026-41012
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vC
When mongosqld is configured with a client certificate authority file, the listener requests a...
CVE-2026-81518
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions...
CVE-2025-64649
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle te