CWE-295 证书验证不恰当 类弱点 675 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trustedcert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-84081 | IBM Guardium 数据保护多漏洞 — Guardium Data Protection | 8.1 | High | 2026-09-18 |
| CVE-2026-84975 | PJSIP TLS证书主机名校验绕过漏洞 — pjproject | 7.4 | High | 2026-09-18 |
| CVE-2026-93601 | rustls webpki 0.103.12前名称约束绕过 — webpki | 2.2 | Low | 2026-09-18 |
| CVE-2026-93600 | rustls webpki 名称约束 URI 校验绕过 — webpki | 2.2 | Low | 2026-09-18 |
| CVE-2026-40539 | Synology DSM Email API证书验证漏洞 — DiskStation Manager (DSM) | 7.1 | High | 2026-09-18 |
| CVE-2026-81447 | 戴尔OpenManage 11.1.0.3前证书验证漏洞 — OpenManage Server Administrator Managed Node (Patch) for Windows | 6.8 | Medium | 2026-09-17 |
| CVE-2026-81871 | OpenTelemetry-Go gRPC导出器TLS证书绕过漏洞 — opentelemetry-go | 6.3 | Medium | 2026-09-16 |
| CVE-2026-20323 | Cisco Secure Firewall 管理组件 认证绕过漏洞 — Cisco Secure Firewall Management Center (FMC) | 8.3 | High | 2026-09-16 |
| CVE-2026-86474 | 固件下载不当证书验证漏洞 — DUOX PLUS monitor firmware (VEO Wi-Fi range) | 7.7 | High | 2026-09-16 |
| CVE-2026-13327 | Devolutions Server 2.16及以前LDAPS证书验证漏洞 — Server | - | - | 2026-09-15 |
| CVE-2026-84850 | Devolutions Server 2026.2.16证书验证漏洞 — Server | - | - | 2026-09-15 |
| CVE-2026-61668 | DIRAC Pilot 未验证 HTTPS 下载漏洞 — DIRAC | 8.1 | High | 2026-09-15 |
| CVE-2026-50166 | Kuma kumactl TLS证书未验证漏洞 — kuma | 5.5 | Medium | 2026-09-15 |
| CVE-2026-52724 | Kuma- DP未配置CA时TLS证书验证绕过漏洞 — kuma | 5.8 | Medium | 2026-09-15 |
| CVE-2026-90623 | Andreas Happe Cochise 授权问题漏洞 — cochise | 3.7 | Low | 2026-09-14 |
| CVE-2026-90651 | Socket Firewall 加密问题漏洞 — Socket Firewall | 8.1 | High | 2026-09-12 |
| CVE-2026-90647 | Kalkitech ASE2000 V2 Communication Test Set 加密问题漏洞 — ASE2000 V2 Communication Test Set | 7.4 | High | 2026-09-12 |
| CVE-2026-90452 | CISA Malcolm 加密问题漏洞 — Malcolm | 6.0 | Medium | 2026-09-11 |
| CVE-2026-87872 | Ansible Community.General 加密问题漏洞 — Red Hat Ceph Storage 5 | 6.8 | Medium | 2026-09-09 |
| CVE-2026-79690 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 3.7 | Low | 2026-09-09 |
| CVE-2026-79736 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 3.7 | Low | 2026-09-09 |
| CVE-2026-79729 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 3.7 | Low | 2026-09-09 |
| CVE-2026-79732 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 3.7 | Low | 2026-09-09 |
| CVE-2026-78483 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 5.9 | Medium | 2026-09-09 |
| CVE-2026-85102 | Check Point Quantum Security Gateway 加密问题漏洞 — Quantum Security Gateway | 9.8 | Critical | 2026-09-09 |
| CVE-2026-78489 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 5.9 | Medium | 2026-09-09 |
| CVE-2026-78492 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 7.4 | High | 2026-09-09 |
| CVE-2026-79637 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 7.7 | High | 2026-09-09 |
| CVE-2026-79967 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 5.6 | Medium | 2026-09-09 |
| CVE-2026-78491 | Dell Secure Connect Gateway 加密问题漏洞 — Secure Connect Gateway 5.0 - Application | 8.2 | High | 2026-09-09 |
CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 675 条 CVE 漏洞。