CVE-2025-60419

An issue was discovered in the NDIS Usermode IO driver RtkIOAC60.sys, version 6.0.5600.16348 allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service...

CVE-2025-50950

A flaw was found in the Audiofile library. Processing a specially crafted input file can trigger a NULL pointer dereference, causing a crash to the application linked to the library and resulting in a denial of service. Mitigation Mitigation for this issue is either not available or the currently...

NewStart CGSL MAIN 7.02 : nodejs Vulnerability (NS-SA-2025-0245)

The remote NewStart CGSL host, running version MAIN 7.02, has nodejs packages installed that are affected by a vulnerability: - Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input...

CVE-2025-60338

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2025-43542

Name of the Vulnerable Software and Affected Versions MCMS version 6.0.1 Description A reflected cross-site scripting XSS issue exists in MCMS version 6.0.1. This allows attackers to execute arbitrary Javascript in the context of a user’s browser through a crafted payload. The attack vector...

EUVD-2025-35584

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60333

TOTOLINK N600R v4.3.0cu.7866B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60334

TOTOLINK N600R v4.3.0cu.7866B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60341

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the ssid parameter in the fastsettingwifiset function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60338

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the DhcpListClient function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60334

TOTOLINK N600R v4.3.0cu.7866B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60342

Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60333

TOTOLINK N600R (v4.3.0cu.7866_B20220506) is affected by a stack overflow in the setWiFiMultipleConfig function caused by an improper validation of the wepkey2 parameter, enabling Denial of Service via crafted input. Documents include a PoC reference and multiple regional advisories; no patch/vers...

CVE-2025-60333

TOTOLINK N600R v4.3.0cu.7866B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in SharpFormUploadField.php. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input. Details Cross-site scripting or XSS is a code vulnerability that occurs when...

openSUSE Security Advisory (SUSE-SU-2025:03624-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JLSEC-2025-101 FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in...

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbsav1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the vfinfo function responsible for handling certain binary files. An attacker can cause a denial of service by providing a specially crafted input file that triggers an out-of-bounds read during processing...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value in the tgtagtype function. An attacker can cause a denial of service by providing crafted input that triggers improper handling of return values. Remediation A fix was pushed into the master branch but not yet...

EUVD-2025-34667

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to a buffer overflow...