Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-62657
Média · 4.9
CWE-599 14/07/2026
Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models
A security flaw in the router's certificate validation process was
discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models that could allow an unauthorized person to remotely access and take
control of the device.
CVE-2026-25060
Alta · 8.1
CWE-599 02/02/2026
OpenList Insecure TLS Default Configuration
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.
CVE-2025-63432
Média · 4.6
CWE-599 24/11/2025
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate…
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.
CVE-2025-56232
Média · 6.8
CWE-599 05/11/2025
GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who…
GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle (MitM) attack to intercept update requests and replace installer or update packages with malicious files.
CVE-2025-56230
Alta · 7.5
CWE-599 04/11/2025
Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation…
Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.
CVE-2025-12553
Crítica · 9.8
CWE-599 31/10/2025
Server Certificate Verification Disabled
Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.