CVE-2026-105222

Published 4 October 2026 · tracked since 5 October 2026

Description

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service request

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105168 MEDIUM 6.3
• CVE-2026-105169 HIGH 7.3
• CVE-2026-105170 HIGH 7.3
• CVE-2026-105171 MEDIUM 6.3
• CVE-2026-105166 HIGH 7.3
• CVE-2026-105167 HIGH 7.3
• CVE-2026-105217 LOW 3.1
• CVE-2026-105219 HIGH 7.5
• CVE-2026-105089 HIGH 8.7
• CVE-2026-105224 MEDIUM 5.4

→ Open the live CVE board · all tools