In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3....

CVE-2026-118696

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2

来源摘录 · NVD

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user...

CVE-2026-115557

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without ce

历史摘要 · 未重新核验 · GitHub Advisory

Electron: Mitigation for compromised eMudhra intermediate certificates

CVE-2026-115570

### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS

历史摘要 · 未重新核验 · GitHub Advisory

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend agai...

CVE-2026-111943

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores

来源摘录 · NVD

No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-102221

No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

历史摘要 · 未重新核验 · NVD

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or...

CVE-2026-94417

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski

历史摘要 · 未重新核验 · GitHub Advisory

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no...

CVE-2026-94417

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski

历史摘要 · 未重新核验 · NVD

CRL check skipped when OCSP enabled and certificate has no OCSP URL

CVE-2026-94417

When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL ski

历史摘要 · 未重新核验 · OSV.dev

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. T...

CVE-2026-73581

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implement

历史摘要 · 未重新核验 · NVD

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingD...

CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares onl

历史摘要 · 未重新核验 · NVD

rustls-webpki before 0.103.10 CRL Revocation Check Bypass

CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares onl

历史摘要 · 未重新核验 · OSV.dev

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) respon...

CVE-2026-93493

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by prov

历史摘要 · 未重新核验 · NVD

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded hos...

CVE-2026-61699

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-

历史摘要 · 未重新核验 · NVD

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date O...

CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final,

历史摘要 · 未重新核验 · NVD

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

CVE-2026-56821

### Summary `OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an e

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh: Certificate revocation is never enforced at the mesh

CVE-2026-61699

### Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that li

历史摘要 · 未重新核验 · GitHub Advisory

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

### Summary `SignedDataVerifier` attempts to perform online revocation checking when `enable_online_checks=True`, but it

历史摘要 · 未重新核验 · GitHub Advisory

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. I...

CVE-2026-6899

Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in th

历史摘要 · 未重新核验 · NVD

sequoia-git has broken hard revocation handling

Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy

历史摘要 · 未重新核验 · GitHub Advisory