https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 12:48:17 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118682 <p>KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user&#39;s proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.</p> <p>KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user&#39;s proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118682 https://db.gcve.eu/vuln/ghsa-wvpm-52pr-rww8 <p>KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user&#39;s proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.</p> <p>KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user&#39;s proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.</p> https://db.gcve.eu/vuln/ghsa-wvpm-52pr-rww8