Monthly
Bilibili Desktop through v1.18.0 achieves full system command execution and credential theft by combining two design-level failures: TLS certificate verification is disabled process-wide (accepting any certificate, including attacker-controlled), and remote JavaScript configuration is fetched and executed without code-signing or integrity validation. Any on-path network adversary - via rogue Wi-Fi, ARP spoofing, or a compromised gateway - can intercept these fetches, present a forged certificate, and inject arbitrary JavaScript that runs in the app's renderer context with direct access to the privileged IPC bridge, enabling OS-level command execution or session-token exfiltration. A public proof-of-concept repository exists (GitHub: LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce); no vendor-released patch has been identified at time of analysis.
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - including custom `checkServerIdentity` callbacks and custom `connector` functions - during JSON-based deep-cloning of the constructor options object. Affected versions span 7.24.1 through 7.29.0 and 8.0.0 through 8.10.1. An attacker performing a network man-in-the-middle attack can present a TLS certificate that passes Node.js's built-in hostname and chain checks but would have been rejected by the application's custom validation logic, allowing an unauthorized TLS session to be silently established. No public exploit code has been identified at time of analysis, but the CVSS I:H and C:H signals confirm the potential for both data interception and traffic tampering.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connections susceptible to man-in-the-middle interception, allowing an unauthenticated network adversary to obtain sensitive information in transit. The flaw is classified under CWE-295, meaning the software either skips certificate chain verification, hostname matching, or revocation checks - permitting a fraudulent certificate to be silently accepted. IBM has released a patch via its support portal; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog.
TLS certificate validation is disabled by default in the Federator component of Eclipse aeriOS, enabling man-in-the-middle interception of all outbound HTTPS connections made by the component. Any attacker who can position themselves on the network path between the Federator and external services - including OAuth authorization servers - can impersonate those services and harvest OAuth client credentials and bearer tokens. This affects only the current pre-release development codebase; a source-level fix is confirmed in commit 9c63b60, but no official tagged release exists. No public exploit or CISA KEV listing has been identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory.
Improper certificate validation in the KrakenD-based API Gateway of Eclipse aeriOS allows a network man-in-the-middle to compromise bearer-token validation. The bundled KrakenD configuration hard-codes disable_jwk_security to true with no Helm override, so KrakenD skips TLS certificate verification (and in the shipped config fetched the JWKS over plaintext HTTP) when retrieving the JSON Web Key Set used to validate JWTs. Only pre-release development builds are affected; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.
Bilibili Desktop through v1.18.0 achieves full system command execution and credential theft by combining two design-level failures: TLS certificate verification is disabled process-wide (accepting any certificate, including attacker-controlled), and remote JavaScript configuration is fetched and executed without code-signing or integrity validation. Any on-path network adversary - via rogue Wi-Fi, ARP spoofing, or a compromised gateway - can intercept these fetches, present a forged certificate, and inject arbitrary JavaScript that runs in the app's renderer context with direct access to the privileged IPC bridge, enabling OS-level command execution or session-token exfiltration. A public proof-of-concept repository exists (GitHub: LeoWSY-hashblue/bilibili-desktop-tls-disabled-rce); no vendor-released patch has been identified at time of analysis.
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - including custom `checkServerIdentity` callbacks and custom `connector` functions - during JSON-based deep-cloning of the constructor options object. Affected versions span 7.24.1 through 7.29.0 and 8.0.0 through 8.10.1. An attacker performing a network man-in-the-middle attack can present a TLS certificate that passes Node.js's built-in hostname and chain checks but would have been rejected by the application's custom validation logic, allowing an unauthorized TLS session to be silently established. No public exploit code has been identified at time of analysis, but the CVSS I:H and C:H signals confirm the potential for both data interception and traffic tampering.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connections susceptible to man-in-the-middle interception, allowing an unauthenticated network adversary to obtain sensitive information in transit. The flaw is classified under CWE-295, meaning the software either skips certificate chain verification, hostname matching, or revocation checks - permitting a fraudulent certificate to be silently accepted. IBM has released a patch via its support portal; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog.
TLS certificate validation is disabled by default in the Federator component of Eclipse aeriOS, enabling man-in-the-middle interception of all outbound HTTPS connections made by the component. Any attacker who can position themselves on the network path between the Federator and external services - including OAuth authorization servers - can impersonate those services and harvest OAuth client credentials and bearer tokens. This affects only the current pre-release development codebase; a source-level fix is confirmed in commit 9c63b60, but no official tagged release exists. No public exploit or CISA KEV listing has been identified at time of analysis.
Improper TLS certificate validation in MISP's CurlClient class allows an adjacent-network attacker to perform man-in-the-middle attacks against outbound HTTPS connections made by the MISP instance, including threat intelligence synchronization. The PHP property `CurlClient::$verifyPeer` was left uninitialized, defaulting to null, which cURL interprets as falsy and therefore disables peer certificate verification. A successful attacker can observe authentication material and exchanged threat intelligence, and inject falsified data into MISP's responses from remote services. No public exploit has been identified; SSVC rates exploitation as none at time of analysis.
Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory.
Improper certificate validation in the KrakenD-based API Gateway of Eclipse aeriOS allows a network man-in-the-middle to compromise bearer-token validation. The bundled KrakenD configuration hard-codes disable_jwk_security to true with no Helm override, so KrakenD skips TLS certificate verification (and in the shipped config fetched the JWKS over plaintext HTTP) when retrieving the JSON Web Key Set used to validate JWTs. Only pre-release development builds are affected; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.