CPython skips server identity checks in ssl.get_server_certificate
Python rates CVE-2026-19552 low: with ca_certs set, the call checks the chain but not the server identity.
Stories per day · 30 days
2 RSS
Relatedtls3lxd2python2ai-tm1apache1authentication-gateway1authpoint1canonical1containers1cpython1denial-of-service1fortimanager1fortinet1fortisase1https1incus1ldap1openssl1
21 stories, newest first · one card per story
Stories tagged #certificate-validation
Fortinet RADIUS certificate flaw lets MITM impersonate the server
A rogue RADIUS server can be impersonated against FortiSASE Sovereign, FortiManager and FortiAnalyzer products, scored CVSS 7.5.
Improper device certificate validation in Siemens SICAM Toolbox II enables AiTM attacks
SEC Consult warns of adversary-in-the-middle attacks due to missing certificate validation in Siemens SICAM Toolbox II device communication; fixed in version 07.11.
WatchGuard AuthPoint Gateway affected by four vulnerabilities
CVEs allow forged LDAP authentication, MITM attacks, unauthenticated DoS, and unauthorized admin actions prior to 7.6.0.
Certificate Validation Flaw in LXD and Incus Allows Unauthenticated Host Control
The flaw lets attackers impersonate trusted certificates during TLS handshakes to bypass authentication in LXD and Incus clusters.
LXD HTTPS listener flaw lets attackers impersonate trusted clients
CVSS 4.0 score is 10.0; fixed releases are 4.0.15, 5.0.11, 5.21.9, and 6.10.1.
Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)
pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.
USN-8926-1: urllib3 vulnerabilities
Ubuntu fixes three urllib3 flaws, including certificate validation bypass and denial-of-service bugs.
USN-8907-1: libgit2 vulnerability
Ubuntu warns libgit2 TLS IP certificate checks can enable a machine-in-the-middle attack.
CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
Apache PLC4X OPC UA driver before 1.0.0 lets a network attacker impersonate the server and bypass integrity.
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
OpenSSL and wolfSSL patched roughly 25 vulnerabilities, including an 8.2-rated DTLS heap data leak and certificate authentication bypasses affecting Nginx and HAProxy builds.
wolfSSL 5.9.4 Patches 11 Security Flaws Affecting TLS and Certificate Validation
wolfSSL 5.9.4 fixes 11 TLS and certificate-validation flaws, including trusted-peer and OCSP authentication bypasses.
wolfSSL 5.9.4 Fixes 11 TLS Security Flaws and Expands Post-Quantum Cryptography Support
wolfSSL 5.9.4 patches 11 TLS vulnerabilities, including three high-severity certificate validation bypasses, and adds post-quantum cryptography features.
Eufy Omni C20, Omni X10 Pro
CISA warns Eufy Omni C20 and X10 Pro versions before 1.6.4 have command injection and certificate flaws.
ZDI-26-741: Foxit PDF Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
ZDI disclosed a FoxitUpdater certificate flaw that lets network-adjacent attackers run code after a user opens a malicious file.
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.
Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.
3
Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks
Check Point patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8), allowing unauthenticated RCE on Security Gateways.
2
FortiOS and FortiProxy ZTNA Validation Vulnerability Allows Attacker to Perform a Man-in-the-Middle Attack
Fortinet discloses high-severity certificate validation flaw CVE-2026-84393 in FortiOS and FortiProxy Agentless ZTNA portals enabling unauthenticated man-in-the-middle attacks.
3
ZTNA Portal Improper Certificate Validation
Fortinet fixed an improper certificate validation flaw (CVSS 7.3) in FortiOS and FortiProxy Agentless ZTNA portal enabling unauthenticated man-in-the-middle attacks on backend traffic.
ZDI-26-558: (Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability
ZDI disclosed a Pwn2Own certificate validation flaw (CVSS 6.8) in Amazon Smart Plug's OTA process, allowing network-adjacent attackers to bypass update verification.