目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-295 证书验证不恰当 类漏洞列表 822

CWE-295 证书验证不恰当 类弱点 822 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-295 属于证书验证不当漏洞，指软件未正确验证数字证书的有效性或完整性。攻击者常利用此缺陷实施中间人攻击，通过伪造证书拦截并篡改通信数据，窃取敏感信息或注入恶意代码。开发者应确保严格校验证书链、域名匹配及有效期，禁用弱算法，并启用证书固定机制，以保障传输层安全，防止身份冒充和数据泄露。

MITRE CWE 官方描述
CWE：CWE-295 证书验证不当 英文：产品未对证书进行验证，或验证不正确。
常见影响 (1)
Integrity, Authentication Bypass Protection Mechanism, Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting s…
缓解措施 (2)
Architecture and Design, Implementation Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
代码示例 (2)
This code checks the certificate of a connected peer.
if ((cert = SSL_get_peer_certificate(ssl)) && host) foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo)) // certificate looks good, host can be trusted
Bad · C
The following OpenSSL code obtains a certificate and verifies it.
cert = SSL_get_peer_certificate(ssl); if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) { // do secret things }
Bad · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-10726 Cato Windows SDP客户端TLS证书验证不当致文件泄露 — SDP Client 6.8 Medium 2026-09-30
CVE-2026-92868 Pgpool-II证书验证不当致认证绕过漏洞 — Pgpool-II 6.9 Medium 2026-09-30
CVE-2026-86131 FortiVoice SSL VPN 代码注入致远程代码执行 — Fireware OS 9.2 Critical 2026-09-29
CVE-2026-97687 urllib3 HTTPS代理TLS配置被忽略漏洞 — urllib3 7.6 High 2026-09-29
CVE-2026-73594 Dell SCG<5.36证书验证缺陷致信息泄露 — Secure Connect Gateway (SCG) Policy Manager 6.4 Medium 2026-09-29
CVE-2026-101916 @grpc/grpc-js 获取认证上下文可绕过认证 — grpc-node 7.4 High 2026-09-28
CVE-2026-89102 OCSP stapling v2多接受非CA链证书作为颁发者 — wolfSSL 8.3 High 2026-09-27
CVE-2026-89133 中间CA未强制执行NameConstraints策略 — wolfSSL 6.3 Medium 2026-09-27
CVE-2026-89134 Subject CN名称约束检查在非DNS SAN存在时被绕过 — wolfSSL 6.3 Medium 2026-09-27
CVE-2026-89135 X509_verify_cert失败导致未验证CA保留在共享CertManager — wolfSSL 6.3 Medium 2026-09-27
CVE-2026-93302 可信对等证书匹配忽略公钥，允许伪造CA克隆 — wolfSSL 8.3 High 2026-09-27
CVE-2026-100835 Contrast 1.16.0 之前远程证明中继攻击漏洞 — contrast 7.4 High 2026-09-27
CVE-2026-100701 Nodemailer 5.0.0-10.0.1 TLS服务器名混淆漏洞 — nodemailer 5.9 Medium 2026-09-26
CVE-2026-100665 Netty 4.2.11至4.2.17 QUIC主机名验证绕过漏洞 — netty 7.5 High 2026-09-26
CVE-2026-100551 OpenClaw iOS控制UI TLS绑定绕过漏洞 — OpenClaw 8.3 High 2026-09-26
CVE-2026-93291 Eufy Omni C20 证书验证不当漏洞 — Omni C20 9.4 Critical 2026-09-24
CVE-2026-82157 Dell ThinOS 10证书验证不当致未授权访问 — ThinOS 10 8.3 High 2026-09-24
CVE-2026-77707 HAVELSAN Liman Render Engine TLS证书验证禁用漏洞 — Liman Render Engine 5.9 Medium 2026-09-24
CVE-2026-67231 RabbitMQ 证书信任存储白名单漏洞 — rabbitmq-server 9.1 Critical 2026-09-23
CVE-2026-67404 RabbitMQ OAuth2 JWKS获取中verify_none回退漏洞 — rabbitmq-server 9.2 Critical 2026-09-23
CVE-2026-73587 Dell SCG 5.34.00.16前证书校验漏洞 — Secure Connect Gateway (SCG) Policy Manager 6.8 Medium 2026-09-23
CVE-2026-91812 Foxit PDF 更新器证书验证本地提权漏洞 — Foxit PDF Editor 7.9 High 2026-09-23
CVE-2026-18173 IBM Financial Transaction Manager 多漏洞 — Financial Transaction Manager (FTM) for RedHat OpenShift 3.7 Low 2026-09-22
CVE-2026-83964 Adobe Connect 证书验证不当漏洞 — Adobe Connect 6.2 Medium 2026-09-22
CVE-2026-63374 AnyIO TLSStream IDNA 2003 编码致 TLS 证书欺骗漏洞 — anyio 9.3 Critical 2026-09-22
CVE-2026-65118 NVIDIA Linux基础设施控制器证书验证漏洞 — Infrastructure Controller 7.5 High 2026-09-22
CVE-2026-65129 NVIDIA Linux控制器证书验证不当漏洞 — Infrastructure Controller 6.7 Medium 2026-09-22
CVE-2026-84081 IBM Guardium 数据保护多漏洞 — Guardium Data Protection 8.1 High 2026-09-18
CVE-2026-84975 PJSIP TLS证书主机名校验绕过漏洞 — pjproject 7.4 High 2026-09-18
CVE-2026-93601 rustls webpki 0.103.12前名称约束绕过 — webpki 2.2 Low 2026-09-18

CWE-295（证书验证不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 822 条 CVE 漏洞。