CVE WatchNov 9, 2026

CVE-2026-112165

The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 9, 2026 · Last modified: Nov 9, 2026 · CWE-295

EPSS · 30d

Not enough EPSS history yet.

Technical description

The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.

Official references

github.comhttps://github.com/livieromarco/security-advisories/blob/main/advisories/CVE-2026-112165.md

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-144355.9 MED

2.5%

——1IBM Turbonomic kubeturbo agent 8.16.0 through 8.20.3 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.6h CVE-2026-144345.9 MED

2.5%

——1IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.9h CVE-2026-143755.9 MED

8.9%

——3IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.1.0 does not validate or improperly validates TLS certificate validation when communicating with remote cluster GUI interfaces, which could allow an attacker to inject forged JSON responses using man in the middle techniques.5h CVE-2026-191296.8 MED

14.8%

——4IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted.3d CVE-2026-173338.0 HIG

12.1%

——4IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.10h CVE-2026-173328.7 HIG

19.7%

——6IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.3d