MEDIUM 6.9 NVD

CVE-2026-106036

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the re

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.

References

https://cert.pl/posts/2026/10/CVE-2026-93570
https://www.elektronicznypodpis.pl/

Published: 2026-10-29 · Source: NVD · Feed updated: 2026-10-29

This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-29 via NVD.

vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.