CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105217

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105218

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105216

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...

CVE-2026-105217

A flaw was found in Cockpit CMS. The application disables Transport Layer Security TLS certificate verification when making background requests to restart web workers. An attacker in a position to intercept network traffic could exploit this flaw by presenting an arbitrary certificate, allowing...

CVE-2026-105218

Versions of gopay prior to 1.5.119 are vulnerable to a Man-in-the-Middle (MitM) attack due to disabled TLS certificate verification within the defaultClient() function in pkg/xhttp/client.go. An attacker can intercept communications by presenting any certificate to read sensitive merchant credent...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

EUVD-2026-92121

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105218 gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105217

The Cockpit CMS (versions 2.12.0 before 2.14.1 ) is vulnerable to a flaw where it disables TLS certificate verification during the cron.php web worker restart request. This allows a man-in-the-middle attacker on the outbound path to the site_url to present a fraudulent certificate and capture the...

CVE-2026-105216 go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...

EUVD-2026-92119

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...

EUVD-2026-92120

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105216

Versions of go-micro before 6.0.0 are vulnerable to an improper certificate validation issue. The root cause is that the shared TLS helper sets InsecureSkipVerify to true by default. This allows network attackers to perform man-in-the-middle (MITM) attacks by presenting arbitrary certificates to ...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-105216 go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...

CVE-2026-105216 go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...

PT-2026-104655

Name of the Vulnerable Software and Affected Versions gist RubyGem versions prior to 6.1.0 Description Improper certificate validation occurs because the http connection function in lib/gist.rb sets VERIFY NONE, which disables TLS certificate verification. This allows on-path attackers to interce...