CVE-2025-12790
High · 7.4CVSS
7.4
EPSS
0.4%
Published
Nov 6, 2025
CISA due date
—
The record
A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | mqtt | 0 | 0.7.0 |
Related vulnerabilities
- CVE-2026-66152 A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor… CWE-29
- CVE-2026-10732 All versions of the package decompress are vulnerable to Arbitrary File Write via Archive… CWE-29
- CVE-2026-24217 NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path… CWE-29
- CVE-2026-5627 A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and… CWE-29
- CVE-2025-15036 A path traversal vulnerability exists in the `extract_archive_to_dir` function within the… CWE-29
- CVE-2026-30828 Wallos is an open-source, self-hostable personal subscription tracker. CWE-29
- CVE-2025-66608 A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. CWE-29
- CVE-2024-2356 A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint… CWE-29