{"id":"CVE-2026-106036","published":"2026-10-29T16:17:47.653","lastModified":"2026-10-29T16:30:07.917","description":"Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.\n\n\n\nThis issue was fixed in version 2.0 build 708.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-295"],"vendors":[],"products":[],"references":[{"url":"https://cert.pl/posts/2026/10/CVE-2026-93570","tags":[]},{"url":"https://www.elektronicznypodpis.pl/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}