CVE-2026-105218

HighCVSS 7.4/10Last modified Oct 6, 2026

Description

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1052197.5Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser CVE-2026-105229.8The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process CVE-2026-1052207.8Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story fil CVE-2026-1052217.4The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS tra CVE-2026-1052227.4The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets CVE-2026-1052237.4maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a ku CVE-2026-1052245.4YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by r CVE-2026-1052254.3A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payme CVE-2026-1052264.7A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file adm CVE-2026-1052277.0This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.CVE-2026-1052287.0This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.CVE-2026-1052297.3A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9