Skip to content
BackEsc
Sign in

weakness in Cryptography

Improper Certificate Validation

69 disclosed reports · $10,490 paid

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

reports
69
paid a bounty
10

Every one of the 69 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. [3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacks#894922Nintendo · 129 votes
  2. SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.#3253725Brave Software · 73 votes
  3. CVE-2025-5025: No QUIC certificate pinning with wolfSSL#3153497curl · 54 votes
  4. CVE-2020-8286: Inferior OCSP verification#1048457curl · 51 votes
  5. CVE-2024-2466: TLS certificate check bypass with mbedTLS (reward request)#2435482Internet Bug Bounty · $2,580 · 48 votes
  6. CVE-2025-10966: missing SFTP host verification with wolfSSH#3355218curl · 43 votes
  7. CVE-2024-2379: QUIC certificate check bypass with wolfSSL#2437050Internet Bug Bounty · $560 · 37 votes
  8. CVE-2024-8096: OCSP stapling bypass with GnuTLS#2669852curl · 36 votes
  9. Acronis True Image (Windows) does not validate server certificate on a TLS connection#1056144Acronis · $500 · 34 votes
  10. CVE-2026-7009: OCSP stapling bypass with Apple SecTrust#3694390curl · 33 votes
  11. Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUST#3374554curl · 30 votes
  12. TLS certificate hostname bypass when the IP is written fullwidth digits#4038287Node.js · 29 votes
  13. X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files#2597504Nextcloud · 27 votes
  14. TLS certificate hostname bypass when the host loosely resolves to an IP address#4006744Node.js · 24 votes
  15. curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authentication#3752567curl · 24 votes
  16. Disk-o Cloud application (Windows) does not validate server certificate on a TLS connection#1026893Mail.ru · $2,500 · 24 votes
  17. GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)#3784125curl · 23 votes
  18. Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation#1278254Node.js · $150 · 20 votes
  19. Insecure HostnameVerifier within WebView of Razer Pay Android (TLS Vulnerability)#795272Razer · $750 · 20 votes
  20. Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.sh#3633146AWS VDP · 18 votes
  21. Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connection#1070533Acronis · $250 · 18 votes
  22. SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's session#3739561curl · 17 votes
  23. Certificate Hostname Validation Bypass via Leading Dot in Hostname#3455037curl · 17 votes
  24. TLS session cache case-folds CA paths and bypasses the active trust profile#3966955curl · 15 votes
  25. Remotely trigger an assertion on a TLS server with a malformed certificate string#746733Node.js · 15 votes
  26. Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints#3962304Node.js · 13 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in