go-pay

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

go-pay records in CISA KEV

No go-pay vulnerabilities are listed in CISA KEV.

Records

1 record

TI-2026-67556 CVE-2026-105218 · GHSA-8f6w-7m2h-mfwg

gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

MEDIUM 40

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00163 Published 2026-10-04 Fixed in 1.5.119 CWE-295

Open these records in search →

Critical	1
High	0
Medium	0
Low	0
No CVSS	0