CWE-297

CVEs per yearBy the year they were published

1. 20141
2. 20161
3. 20172
4. 20181
5. 20191
6. 20204
7. 20214
8. 20222
9. 20238
10. 20248
11. 202511
12. 202654

Newest CVEs

• CVE-2026-123848

  In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

  JetBrains · IntelliJ IDEA

  High7.4
• CVE-2026-112339

  Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Module

  wazuh · wazuh

  High8.2
• CVE-2026-109408

  vault-java-driver: SslConfig silently disables requested TLS verification

  jopenlibs · vault-java-driver

  High7.4
• CVE-2026-115758

  SumatraPDF: TLS hostname validation disabled in `HttpGet()`

  sumatrapdfreader · sumatrapdf

  High8.2
• CVE-2026-117666

  ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

  deadtrickster · ssl_verify_fun

  Critical9.1
• CVE-2026-66392

  Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names

  Apache Software Foundation · Apache bRPC

  Medium5.9
• CVE-2026-86410

  redirect to SFTP or SCP bypasses host verification

  curl · curl

  High8.1
• CVE-2026-85974

  Improper TLS hostname verification in Progress MarkLogic Server

  Progress Software Corporation · MarkLogic Server

  High7.4
• CVE-2026-107819

  MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

  MariaDB · server

  Medium5.9
• CVE-2026-107938

  Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

  Apache Software Foundation · Apache CXF

  Critical9.1

Vendors it comes up for most

1. Apache Software Foundation14
2. curl5
3. Dell4
4. Fortinet4
5. IBM4
6. Palantir4
7. Red Hat3
8. Circle Media2
9. JetBrains2
10. Spring2