The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
Volume of CVEs assigned to CWE-599 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-12553CRITICAL Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | Oct 31, 2025 | 9.8 | 31 | NO | NO |
CVE-2022-31105CRITICAL Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper cer | Jul 12, 2022 | 9.6 | 28 | NO | NO |
CVE-2026-62657MEDIUM A security flaw in the router's certificate validation process was
discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized pers | Jul 14, 2026 | 4.9 | 26 | NO | NO |
CVE-2021-21374HIGH Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTP | Mar 26, 2021 | 8.1 | 25 | NO | NO |
CVE-2025-56230HIGH Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. | Nov 4, 2025 | 7.5 | 24 | NO | NO |
CVE-2024-40464HIGH An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file | Jul 31, 2024 | 8.8 | 24 | NO | NO |
CVE-2026-25060HIGH OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify | Feb 2, 2026 | 8.1 | 23 | NO | NO |
CVE-2025-56232MEDIUM GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle (MitM) attack to int | Nov 5, 2025 | 6.8 | 23 | NO | NO |
CVE-2024-41265HIGH A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function. | Aug 1, 2024 | 7.5 | 22 | NO | NO |
CVE-2024-41253HIGH goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component. | Jul 31, 2024 | 7.1 | 21 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.