Total
398656 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-43983 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages. | |||||
| CVE-2025-43982 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be disabled in the GUI. | |||||
| CVE-2025-43980 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI doesn't offer a way to disable the account. | |||||
| CVE-2025-43979 | 2026-06-17 | N/A | 7.4 HIGH | ||
| An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root privileges via crafted payloads to the xml_action.cgi?method= endpoint. | |||||
| CVE-2025-43978 | 2026-06-17 | N/A | 7.4 HIGH | ||
| Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_pin and /ubus/?flag=netAppStar1 and /ubus/?flag=set_wifi_cfgs. This allows an authenticated attacker to execute arbitrary OS commands with root privileges via crafted inputs to the SSID, WPS, Traceroute, and Ping fields. | |||||
| CVE-2025-43977 | 1 Sktelecom | 1 Com.skt.prod.dialer | 2026-06-17 | N/A | 5.5 MEDIUM |
| The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster component. | |||||
| CVE-2025-43976 | 1 Textnow | 1 2ndline | 2026-06-17 | N/A | 5.5 MEDIUM |
| The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component. | |||||
| CVE-2025-43973 | 1 Osrg | 1 Gobgp | 2026-06-17 | N/A | 6.8 MEDIUM |
| An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message. | |||||
| CVE-2025-43972 | 1 Osrg | 1 Gobgp | 2026-06-17 | N/A | 6.8 MEDIUM |
| An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context. | |||||
| CVE-2025-43971 | 1 Osrg | 1 Gobgp | 2026-06-17 | N/A | 8.6 HIGH |
| An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. | |||||
| CVE-2025-43970 | 1 Osrg | 1 Gobgp | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family). | |||||
| CVE-2025-43967 | 1 Struktur | 1 Libheif | 2026-06-17 | N/A | 2.9 LOW |
| libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item. | |||||
| CVE-2025-43966 | 1 Struktur | 1 Libheif | 2026-06-17 | N/A | 2.9 LOW |
| libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. | |||||
| CVE-2025-43965 | 2 Debian, Imagemagick | 2 Debian Linux, Imagemagick | 2026-06-17 | N/A | 2.9 LOW |
| In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. | |||||
| CVE-2025-43964 | 1 Libraw | 1 Libraw | 2026-06-17 | N/A | 2.9 LOW |
| In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. | |||||
| CVE-2025-43963 | 1 Libraw | 1 Libraw | 2026-06-17 | N/A | 2.9 LOW |
| In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing. | |||||
| CVE-2025-43962 | 1 Libraw | 1 Libraw | 2026-06-17 | N/A | 2.9 LOW |
| In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations. | |||||
| CVE-2025-43961 | 1 Libraw | 1 Libraw | 2026-06-17 | N/A | 2.9 LOW |
| In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. | |||||
| CVE-2025-43960 | 1 Adminer | 1 Adminer | 2026-06-17 | N/A | 8.6 HIGH |
| Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention. | |||||
| CVE-2025-43954 | 1 Quasar | 1 Qmarkdown | 2026-06-17 | N/A | 4.9 MEDIUM |
| QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set. | |||||