CWE-297

CVEs per yearBy the year they were published

1. 20141
2. 20161
3. 20172
4. 20181
5. 20191
6. 20204
7. 20214
8. 20222
9. 20238
10. 20248
11. 202511
12. 202652

Newest CVEs

• CVE-2026-109408

  vault-java-driver: SslConfig silently disables requested TLS verification

  jopenlibs · vault-java-driver

  High7.4
• CVE-2026-115758

  SumatraPDF: TLS hostname validation disabled in `HttpGet()`

  sumatrapdfreader · sumatrapdf

  High8.2
• CVE-2026-117666

  ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

  deadtrickster · ssl_verify_fun

  Critical9.1
• CVE-2026-66392

  Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names

  Apache Software Foundation · Apache bRPC

  Medium5.9
• CVE-2026-86410

  redirect to SFTP or SCP bypasses host verification

  curl · curl

  High8.1
• CVE-2026-85974

  Improper TLS hostname verification in Progress MarkLogic Server

  Progress Software Corporation · MarkLogic Server

  High7.4
• CVE-2026-107819

  MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

  MariaDB · server

  Medium5.9
• CVE-2026-107938

  Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

  Apache Software Foundation · Apache CXF

  Critical9.1
• CVE-2026-107660

  FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts

  FFmpeg · FFmpeg

  Medium6.3
• CVE-2026-88647

  GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7)…

  Product not named

  Medium6.5

Vendors it comes up for most

1. Apache Software Foundation14
2. curl5
3. Dell4
4. Fortinet4
5. IBM4
6. Palantir4
7. Red Hat3
8. Circle Media2
9. Spring2
10. pjsip2