CWE-295 证书验证不恰当 类弱点 822 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trustedcert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-112105 | GlitterWare Passy TLS 证书验证绕过漏洞 — Passy | 3.7 | Low | 2026-10-19 |
| CVE-2026-112103 | FatFreeCore 未验证证书漏洞 — fatfree-core | 3.7 | Low | 2026-10-19 |
| CVE-2026-112037 | Diem gapi.class.php 证书验证绕过漏洞 — diem | 3.7 | Low | 2026-10-19 |
| CVE-2026-112006 | OpenTelemetry 1.5.0-1.45.0 证书验证漏洞 — opentelemetry-exporter-otlp-proto-http | 6.5 | Medium | 2026-10-18 |
| CVE-2026-16754 | 联想C33摄像头证书验证漏洞 — Smart Camera C33 | 4.8 | Medium | 2026-10-15 |
| CVE-2026-109383 | undici TLS证书验证绕过漏洞 — undici | 7.4 | High | 2026-10-15 |
| CVE-2023-32198 | Steve 不验证服务器证书，易受中间人攻击 — steve | 8.0 | High | 2026-10-15 |
| CVE-2025-23390 | Fleet SSH连接未验证服务器证书漏洞 — fleet | 6.3 | Medium | 2026-10-15 |
| CVE-2026-19377 | Cato Client 证书验证不当漏洞 — Cato Client for Windows | 6.0 | Medium | 2026-10-15 |
| CVE-2026-105236 | TLS 1.2 session resumption 在 ssl 中跨越 SNI 虚拟主机客户端证书信任边界 — OTP | 6.3 | Medium | 2026-10-14 |
| CVE-2026-91881 | Dell Terraform Provider <1.6.2证书验证绕过漏洞 — Terraform Provider for Redfish | 9.0 | Critical | 2026-10-14 |
| CVE-2026-103294 | CAI Content Credentials 证书验证漏洞 — Content Credentials Rust SDK | 5.9 | Medium | 2026-10-13 |
| CVE-2026-100116 | CAI Content Credentials 证书验证不当漏洞 — Content Credentials Rust SDK | 5.9 | Medium | 2026-10-13 |
| CVE-2026-100123 | CAI Content Credentials 证书验证漏洞 — Content Credentials Rust SDK | 7.5 | High | 2026-10-13 |
| CVE-2026-100122 | CAI Content Credentials 证书验证不当漏洞 — Content Credentials Rust SDK | 7.5 | High | 2026-10-13 |
| CVE-2026-100121 | CAI Content Credentials 证书验证漏洞 — Content Credentials Rust SDK | 7.5 | High | 2026-10-13 |
| CVE-2026-100118 | CAI内容凭证不当证书验证漏洞 — Content Credentials Rust SDK | 7.5 | High | 2026-10-13 |
| CVE-2026-77816 | IBM WebSphere Liberty 证书验证不当漏洞 — WebSphere Application Server - Liberty | 6.5 | Medium | 2026-10-13 |
| CVE-2026-108131 | Active Directory Federation Services (AD FS) 欺骗漏洞 — Windows 10 Version 1607 | 7.5 | High | 2026-10-13 |
| CVE-2026-96222 | AD FS 欺骗漏洞 — Microsoft .NET Framework 3.5 | 7.4 | High | 2026-10-13 |
| CVE-2026-70194 | .NET Framework 安全功能绕过漏洞 — .NET 11.0 runtime | 6.5 | Medium | 2026-10-13 |
| CVE-2026-83926 | Windows Hello 安全功能绕过漏洞 — Windows 10 Version 1809 | 4.4 | Medium | 2026-10-13 |
| CVE-2026-108185 | Zoom客户端信息泄露漏洞 — Zoom Clients | 7.4 | High | 2026-10-13 |
| CVE-2026-108184 | Zoom客户端Windows版证书验证缺陷致信息泄露 — Zoom Clients | 7.4 | High | 2026-10-13 |
| CVE-2026-78556 | Industrial Edge App Publisher TLS证书验证绕过漏洞 — Industrial Edge App Publisher | 7.4 | High | 2026-10-13 |
| CVE-2026-84418 | DataStage on Cloud Pak for Data 证书验证不当漏洞 — DataStage on Cloud Pak for Data | 7.4 | High | 2026-10-12 |
| CVE-2026-109423 | 网易云音乐 TLS证书验证绕过漏洞 — NetEase Cloud Music for Windows | 7.4 | High | 2026-10-12 |
| CVE-2026-109245 | FreeRDP 3.0.0-3.31.0 证书验证漏洞 — FreeRDP | 6.8 | Medium | 2026-10-12 |
| CVE-2026-103503 | Hex cacerts_path 配置信任捆绑CA证书漏洞 — hex | 5.9 | Medium | 2026-10-12 |
| CVE-2026-109399 | SWUpdate CMS签名验证绕过漏洞 — swupdate | 8.1 | High | 2026-10-12 |
CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 822 条 CVE 漏洞。