The vulnerability of the GlancesXMLRPCCHandler() and GlancesXMLRPCServer() classes in the glances/server.py file of the Glances monitoring tool’s application programming interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GlancesXMLRPCHandler and GlancesXMLRPCServer methods in the glances/server.py file of the Glances monitoring tool’s application programming interface is related to a deficiency in the source verification mechanism. Exploiting this vulnerability could allow an attacker to...

MikroTik RouterOS Improper Verification of Cryptographic Signature (CVE-2026-67276)

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...

CVE-2026-105222

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222

The alexpechkarev/google-maps Laravel package, through version 12.16 , is vulnerable to a Disabled TLS Certificate Verification flaw. The bundled configuration sets ssl_verify_peer to FALSE , which is then passed to CURLOPT_SSL_VERIFYPEER. This allows on-path attackers to present arbitrary certif...

CVE-2026-105217

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105218

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105161

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

CVE-2026-105217

A flaw was found in Cockpit CMS. The application disables Transport Layer Security TLS certificate verification when making background requests to restart web workers. An attacker in a position to intercept network traffic could exploit this flaw by presenting an arbitrary certificate, allowing...

CVE-2026-105218

Versions of gopay prior to 1.5.119 are vulnerable to a Man-in-the-Middle (MitM) attack due to disabled TLS certificate verification within the defaultClient() function in pkg/xhttp/client.go. An attacker can intercept communications by presenting any certificate to read sensitive merchant credent...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

EUVD-2026-92121

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105217

The Cockpit CMS (versions 2.12.0 before 2.14.1 ) is vulnerable to a flaw where it disables TLS certificate verification during the cron.php web worker restart request. This allows a man-in-the-middle attacker on the outbound path to the site_url to present a fraudulent certificate and capture the...

EUVD-2026-92120

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...