Skip to content
CVE Tracker

CWE-295: Improper certificate validation

1,726 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 6 of them as exploited in the wild.

All 1,726 in the listAtom feed of new CVEsWhat CWE-295 is, at MITRE (opens in a new tab)
Published CVEs
1,726
Last 12 months
521
Critical
187
Known exploited
6

Critical 187High 675Medium 781Low 82Not scored 1

CVEs per yearBy the year they were published

  1. 201997
  2. 201918
  3. 20201
  4. 20211
  5. 20227
  6. 2023117
  7. 2023123
  8. 2023133
  9. 2024126
  10. 2024117
  11. 2026452
  12. 2026157

Known exploitedNewest addition to KEV first

  • CVE-2026-85102

    Improper Certificate Validation in Quantum Security Gateway

    checkpoint · Quantum Security Gateway

    ExploitedCritical9.8
  • CVE-2023-41991

    A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass…

    Apple · iOS and iPadOS

    ExploitedMedium5.5
  • CVE-2023-20963

    In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User…

    Android

    ExploitedHigh7.8
  • CVE-2022-26923

    Active Directory Domain Services Elevation of Privilege Vulnerability

    Microsoft · Windows 10 Version 1809

    ExploitedHigh8.8
  • CVE-2022-20703

    Cisco Small Business RV Series Routers Vulnerabilities

    Cisco · Cisco Small Business RV Series Router Firmware

    ExploitedCritical10.0
  • CVE-2020-0601

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit…

    Microsoft · Windows

    ExploitedHigh8.1

Newest CVEs

  • CVE-2026-121565

    Tanium addressed an improper certificate validation vulnerability in multiple products

    Tanium · TanOS

    High7.4
  • CVE-2026-121624

    Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

    Nanosystems · Supremo

    High7.6
  • CVE-2026-115714

    Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections

    Elastic · Elastic Docker images

    High7.4
  • CVE-2026-121452

    bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service

    mlogclub · bbs-go

    High8.3
  • CVE-2026-121392

    FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate

    FreeRDP · FreeRDP

    Critical9.1
  • CVE-2026-91897

    Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with…

    Dell · Alienware Command Center (AWCC)

    Medium6.4
  • CVE-2026-120250

    OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections

    marketcalls · OpenAlgo

    Medium6.0
  • CVE-2026-118147

    Visual Studio Spoofing Vulnerability

    Microsoft · Microsoft Visual Studio 2017 version 15.9

    High7.4
  • CVE-2026-117681

    Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone

    konflux-ci

    High8.0
  • CVE-2026-118697

    In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion…

    JetBrains · Toolbox App

    Critical9.0

Vendors it comes up for most

  1. IBM60
  2. Dell57
  3. Apache Software Foundation44
  4. Cisco33
  5. Jenkins Project27
  6. Red Hat27
  7. Microsoft25
  8. wolfSSL21
  9. Fortinet20
  10. Mozilla17