Improper Following of a Certificate's Chain of Trust

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostname…CVE-2021-44532NodeJS · 10% likely

   Node.js1 bounty report

2. It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the us…CVE-2019-3890The Gnome Project · CVSS 8.1 · 1.0% likely

   Gnome

3. Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation VulnerabilityCVE-2021-1566Cisco · CVSS 7.4 · 0.7% likely

   Cisco

4. Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentiall…CVE-2019-3762Dell · CVSS 7.5 · 0.6% likely

   Dell

5. Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallag…CVE-2021-23155Gallagher · CVSS 9 · 0.5% likely

   Gallagher

6. Icinga 2 certificate renewal might incorrectly renew an invalid certificateCVE-2025-48057Icinga · CVSS 9.3 · 0.5% likely

   Icinga

7. Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management InterfaceCVE-2026-44852Hewlett Packard Enterprise (HPE) · CVSS 7.2 · 0.4% likely

   Hewlett Packard Enterprise

8. Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Galla…CVE-2021-23162Gallagher · CVSS 7.7 · 0.4% likely

   Gallagher

9. Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic…CVE-2025-22459Ivanti · CVSS 4.8 · 0.4% likely

   Ivanti

10. Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autenticationCVE-2026-27134strimzi · CVSS 8.1 · 0.4% likely

    Strimzi

11. Non-CA certificate accepted as intermediate issuer in public_key path validationCVE-2026-42789Erlang · CVSS 8 · 0.4% likely

    Erlang

12. s2s-proxy accepts untrusted client certificatesCVE-2026-96770Temporal Technologies, Inc. · CVSS 9.3 · 0.3% likely

    Temporal Technologies, Inc.

13. CrowdStrike Falcon Sensor for Linux TLS IssueCVE-2025-1146CrowdStrike · CVSS 8.1 · 0.3% likely

    CrowdStrike

14. IBM OpenPages data manipulationCVE-2024-43196IBM · CVSS 4.3 · 0.2% likely

    IBM

15. Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clustersCVE-2026-27133strimzi · CVSS 5.9 · 0.2% likely

    Strimzi

16. Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking AppCVE-2025-10539DeskTime · CVSS 4.8 · 0.2% likely
17. Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the prod…CVE-2026-73542SEIKO EPSON CORPORATION · CVSS 3.7 · 0.2% likely

    SEIKO EPSON CORPORATION

18. Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communicationCVE-2026-33779Juniper Networks · CVSS 6.5 · 0.1% likely

    Juniper Networks

19. Slate Digital Connect macOS XPC certificate validation privilege escalationCVE-2026-24066Slate Digital LLC · CVSS 8.4 · 0.1% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.