By weakness (CWE)

CWE-295: related vulnerabilities

CVEs classified under CWE-295. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2026-45745HIGH 8.0

  Termix Desktop, a web-based server management application built on Electron, has a critical flaw in how it validates HTTPS certificates. Starting from version 1.7.0, the application disables TLS certificate validation entirely, which means attackers on the same network can impersonate the Termix server and intercept all traffic between your desktop client and the management server. This creates a direct path to stealing login credentials and session tokens while you work.

• CVE-2026-41859HIGH 7.8

  BOSH nats-sync, a component that synchronizes NATS authorization data with BOSH director state, fails to validate SSL/TLS certificates when communicating with the BOSH director. An attacker positioned on the network between nats-sync and the director can intercept traffic, steal administrative credentials (HTTP Basic auth headers or UAA client secrets), and modify the list of VMs that nats-sync writes to the NATS authorization file. This combination of credential theft and authorization tampering could grant attackers full administrative control of the BOSH deployment.

• CVE-2026-44393HIGH 7.4

  OpenStack's oslo.messaging library contains a critical flaw in how it validates TLS certificates when connecting to RabbitMQ brokers. The driver accepts any certificate signed by your organization's CA without checking that it actually belongs to the RabbitMQ server you're trying to reach. This means an attacker positioned on your network could intercept traffic, present a valid (but wrong) certificate, and trick OpenStack services into sending sensitive control-plane messages to the attacker instead of RabbitMQ. The vulnerability affects all versions from 1.0.0 through 17.3.0.

• CVE-2026-50752HIGH 7.4

  CVE-2026-50752 is a flaw in how older VPN key exchange protocols validate certificates. An attacker positioned between two VPN endpoints can forge or bypass certificate checks, allowing them to intercept or alter traffic passing through the tunnel. The vulnerability requires the attacker to be on the network path between sites and affects only VPN connections using the deprecated IKEv1 protocol with certificate-based authentication. This is a high-severity issue because successful exploitation grants access to encrypted traffic that organizations rely on for secure branch-to-branch or cloud communications.

• CVE-2026-49267MEDIUM 5.9

  Apache Airflow's EmailOperator and email utilities fail to validate the SMTP server's certificate when configured to use STARTTLS encryption without full SSL/TLS. This allows an attacker on the network between your Airflow worker and SMTP server to intercept the connection, inject a fraudulent certificate, and steal login credentials and email contents without detection. The risk is elevated in environments where the SMTP relay sits outside your trusted network perimeter.

• CVE-2026-42769MEDIUM 5.3

  A defect in OpenSSL's Certificate Management Protocol (CMP) implementation allows an attacker with valid Registration Authority credentials to trick CMP clients into accepting a forged root CA certificate as legitimate. The flaw stems from a typo in certificate chain validation code that disabled critical signature verification checks during root CA key rollover operations. While the vulnerability requires the attacker to already possess RA-level credentials, successful exploitation would grant them root CA authority over affected clients—a significant privilege escalation. The FIPS module implementation of OpenSSL is not affected.