CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105221

The gist RubyGem before version 6.1.0 is vulnerable to an improper certificate validation flaw. The root cause is located in lib/gist.rb, where the http_connection function sets VERIFY_NONE, effectively disabling TLS certificate verification. This allows on-path attackers to intercept HTTPS traff...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

PT-2026-104655

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http connection in lib/gist.rb sets VERIFY NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth toke...

PT-2026-58855

Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...