By weakness (CWE)

CWE-297: related vulnerabilities

CVEs classified under CWE-297. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-35563HIGH 8.5

  A flaw in Apache Directory LDAP API version 2.1.7 allows an attacker with network interception capability to impersonate an LDAP server. The library validates that a certificate is signed by a trusted authority but fails to confirm that the certificate was actually issued for the LDAP server being connected to. An attacker positioned between a client and server can present any valid certificate from their trust store, hijacking the connection and accessing sensitive authentication and directory data.

• CVE-2026-54275HIGH 7.5

  AIOHTTP, a popular Python framework for asynchronous HTTP communication, has a TLS validation weakness in versions before 3.14.1. When applications reuse connections to the same domain while changing the server_hostname parameter between requests, the library may incorrectly allow connections that should be rejected. This means an attacker could potentially intercept traffic if they control the network path and the application is configured to use different hostnames for the same connection pool.

• CVE-2026-44393HIGH 7.4

  OpenStack's oslo.messaging library contains a critical flaw in how it validates TLS certificates when connecting to RabbitMQ brokers. The driver accepts any certificate signed by your organization's CA without checking that it actually belongs to the RabbitMQ server you're trying to reach. This means an attacker positioned on your network could intercept traffic, present a valid (but wrong) certificate, and trick OpenStack services into sending sensitive control-plane messages to the attacker instead of RabbitMQ. The vulnerability affects all versions from 1.0.0 through 17.3.0.

• CVE-2026-12162MEDIUM 5.5

  Devolutions Remote Desktop Manager version 2026.2.8 contains a flaw in how it validates the identity of social login providers during the autofill process. An attacker can craft a malicious web entry pointing to a lookalike domain that mimics a legitimate social login provider. When a user interacts with this entry, the application fails to properly verify the provider's authenticity, potentially exposing stored social login credentials to the attacker. This is a social engineering vulnerability that exploits the trust users place in the autofill mechanism.