CWE-297 · 87 records
Improper Validation of Certificate with Host Mismatch
CVEs in this class
87 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2025-46408Proof of concept | An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpCavtech · eagleeyes\(lite\) · CWE-297 | Critical9.8 | — | 0.6% | Sep 15, 2025 |
37Monitor | CVE-2026-59638No exploit | JSSE hostname verifier CN-fallback enabled by default despite documented opt-inbouncycastle · bc-java · CWE-297 | Critical9.3 | — | 0.3% | Aug 2, 2026 |
37Monitor | CVE-2026-47840No exploit | LDAP StartTLS unconditionally disables hostname verificationcloudfoundry foundation · uaa · CWE-297 | Critical9.3 | — | 0.2% | Jul 9, 2026 |
36Monitor | CVE-2020-1887No exploit | Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffilinuxfoundation · osquery · CWE-297 | Critical9.1 | — | 1.5% | Mar 12, 2020 |
36Monitor | CVE-2021-33695No exploit | Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.sap · cloud connector · CWE-297 | Critical9.1 | — | 0.5% | Sep 15, 2021 |
36Monitor | CVE-2026-48144No exploit | Apache Thrift: c_glib TLS Client Missing Hostname Verificationapache · thrift · CWE-297 | Critical9.1 | — | 0.4% | Jul 27, 2026 |
36Monitor | CVE-2026-92943No exploit | Improper validation of certificate with host mismatch in AWS IoT Device SDK for Pythonaws · awsiotpythonsdk · CWE-297 | Critical9.2 | — | 0.3% | Sep 17, 2026 |
36Monitor | CVE-2025-68637No exploit | Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Clientapache · uniffle · CWE-297 | Critical9.1 | — | 0.2% | Jan 7, 2026 |
36Monitor | CVE-2026-26214No exploit | Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITMxiaomi technology co., ltd. · galaxy fds android sdk · CWE-297 | Critical9.1 | — | 0.2% | Feb 12, 2026 |
36Monitor | CVE-2026-107938No exploit | Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.apache · cxf · CWE-297 | Critical9.1 | — | 0.1% | Oct 9, 2026 |
36Monitor | CVE-2026-117666No exploit | ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundarydeadtrickster · ssl_verify_fun · CWE-297 | Critical9.1 | — | 0.1% | 4 days ago |
36Monitor | CVE-2026-15925No exploit | Improper TLS Hostname Verification in Snowflake Connector for Pythonsnowflake · snowflake connector for python · CWE-297 | Critical9.2 | — | 0.1% | Jul 16, 2026 |
35Monitor | CVE-2026-35563No exploit | Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostnameapache · directory ldap api · CWE-297 | High8.8 | — | 0.1% | Jun 1, 2026 |
34Monitor | CVE-2026-62243No exploit | Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypassnetty · netty · CWE-297 | High8.7 | — | 0.1% | Aug 22, 2026 |
33Monitor | CVE-2018-10936Proof of concept | A weakness was found in postgresql-jdbc before version 42.2.5.postgresql · postgresql jdbc driver · CWE-297 | High8.1 | — | 2.9% | Aug 30, 2018 |
32Monitor | CVE-2022-32153No exploit | Splunk Enterprise lacked TLS host name validationsplunk · splunk · CWE-297 | High8.1 | — | 0.9% | Jun 15, 2022 |
32Monitor | CVE-2020-11050No exploit | Improper Validation of Certificate with Host Mismatch in Java-WebSocketjava-websocket project · java-websocket · CWE-297 | High8.1 | — | 0.7% | May 7, 2020 |
32Monitor | CVE-2026-86410No exploit | redirect to SFTP or SCP bypasses host verificationcurl · curl · CWE-297 | High8.1 | — | 0.7% | Oct 20, 2026 |
32Monitor | CVE-2025-3501No exploit | Org.keycloak.protocol.services: keycloak hostname verificationred hat · red hat build of keycloak · CWE-297 | High8.2 | — | 0.4% | Apr 29, 2025 |
32Monitor | CVE-2024-32868Proof of concept | ZITADEL's Improper Lockout Mechanism Leads to MFA Bypasszitadel · zitadel · CWE-297 | High8.1 | — | 0.4% | Apr 25, 2024 |
32Monitor | CVE-2026-48145No exploit | Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypassapache · thrift · CWE-297 | High8.2 | — | 0.4% | Jul 27, 2026 |
32Monitor | CVE-2024-49782No exploit | IBM OpenPages improper certificate validationibm · openpages with watson · CWE-297 | High8.2 | — | 0.3% | Feb 20, 2025 |
32Monitor | CVE-2025-2190No exploit | The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.tecno · com.transsnet.store · CWE-297 | High8.1 | — | 0.3% | Mar 11, 2025 |
32Monitor | CVE-2026-84393No exploit | A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.fortinet · fortios · CWE-297 | High8.1 | — | 0.2% | Sep 8, 2026 |
32Monitor | CVE-2026-22747Proof of concept | Unauthorized User Impersonation when Using X.509 Client Certificatesvmware · spring security · CWE-297 | High8.1 | — | 0.2% | Apr 22, 2026 |
- CVE-2025-4640839Monitor
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpC
CriticalCVSS 9.8Proof of conceptEPSS 0%avtech · eagleeyes\(lite\)Sep 15, 2025
- CVE-2026-5963837Monitor
JSSE hostname verifier CN-fallback enabled by default despite documented opt-in
CriticalCVSS 9.3No exploitEPSS 0%bouncycastle · bc-javaAug 2, 2026
- CVE-2026-4784037Monitor
LDAP StartTLS unconditionally disables hostname verification
CriticalCVSS 9.3No exploitEPSS 0%cloudfoundry foundation · uaaJul 9, 2026
- CVE-2020-188736Monitor
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffi
CriticalCVSS 9.1No exploitEPSS 1%linuxfoundation · osqueryMar 12, 2020
- CVE-2021-3369536Monitor
Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.
CriticalCVSS 9.1No exploitEPSS 0%sap · cloud connectorSep 15, 2021
- CVE-2026-4814436Monitor
Apache Thrift: c_glib TLS Client Missing Hostname Verification
CriticalCVSS 9.1No exploitEPSS 0%apache · thriftJul 27, 2026
- CVE-2026-9294336Monitor
Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python
CriticalCVSS 9.2No exploitEPSS 0%aws · awsiotpythonsdkSep 17, 2026
- CVE-2025-6863736Monitor
Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client
CriticalCVSS 9.1No exploitEPSS 0%apache · uniffleJan 7, 2026
- CVE-2026-2621436Monitor
Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM
CriticalCVSS 9.1No exploitEPSS 0%xiaomi technology co., ltd. · galaxy fds android sdkFeb 12, 2026
- CVE-2026-10793836Monitor
Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
CriticalCVSS 9.1No exploitEPSS 0%apache · cxfOct 9, 2026
- CVE-2026-11766636Monitor
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
CriticalCVSS 9.1No exploitEPSS 0%deadtrickster · ssl_verify_fun4 days ago
- CVE-2026-1592536Monitor
Improper TLS Hostname Verification in Snowflake Connector for Python
CriticalCVSS 9.2No exploitEPSS 0%snowflake · snowflake connector for pythonJul 16, 2026
- CVE-2026-3556335Monitor
Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname
HighCVSS 8.8No exploitEPSS 0%apache · directory ldap apiJun 1, 2026
- CVE-2026-6224334Monitor
Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
HighCVSS 8.7No exploitEPSS 0%netty · nettyAug 22, 2026
- CVE-2018-1093633Monitor
A weakness was found in postgresql-jdbc before version 42.2.5.
HighCVSS 8.1Proof of conceptEPSS 2%postgresql · postgresql jdbc driverAug 30, 2018
- CVE-2022-3215332Monitor
Splunk Enterprise lacked TLS host name validation
HighCVSS 8.1No exploitEPSS 0%splunk · splunkJun 15, 2022
- CVE-2020-1105032Monitor
Improper Validation of Certificate with Host Mismatch in Java-WebSocket
HighCVSS 8.1No exploitEPSS 0%java-websocket project · java-websocketMay 7, 2020
- CVE-2026-8641032Monitor
redirect to SFTP or SCP bypasses host verification
HighCVSS 8.1No exploitEPSS 0%curl · curlOct 20, 2026
- CVE-2025-350132Monitor
Org.keycloak.protocol.services: keycloak hostname verification
HighCVSS 8.2No exploitEPSS 0%red hat · red hat build of keycloakApr 29, 2025
- CVE-2024-3286832Monitor
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
HighCVSS 8.1Proof of conceptEPSS 0%zitadel · zitadelApr 25, 2024
- CVE-2026-4814532Monitor
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
HighCVSS 8.2No exploitEPSS 0%apache · thriftJul 27, 2026
- CVE-2024-4978232Monitor
IBM OpenPages improper certificate validation
HighCVSS 8.2No exploitEPSS 0%ibm · openpages with watsonFeb 20, 2025
- CVE-2025-219032Monitor
The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.
HighCVSS 8.1No exploitEPSS 0%tecno · com.transsnet.storeMar 11, 2025
- CVE-2026-8439332Monitor
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.
HighCVSS 8.1No exploitEPSS 0%fortinet · fortiosSep 8, 2026
- CVE-2026-2274732Monitor
Unauthorized User Impersonation when Using X.509 Client Certificates
HighCVSS 8.1Proof of conceptEPSS 0%vmware · spring securityApr 22, 2026