CVE-2026-79785: X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto

X-AnyLabeling's model downloader has a serious security flaw where it disables TLS certificate verification (the process that confirms you're connecting to the real website and not an imposter), allowing attackers who can intercept internet traffic to replace downloaded AI models with malicious ones. The application only checks if downloaded files are valid formats, not whether they came from a trusted source, so attackers can inject malicious code that executes when the model runs.