Threats affecting pkg:deb/debian/grub2

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.4	EPSS 0.1%	CVE-2026-97876GNU grub2 · Untrusted Pointer Dereference Medium6.4EPSS 0.1%2026-10-02CVE Database V5CVE-2026-97876 CVE-2026-97876 is a vulnerability in GNU grub2 where a local attacker with control over GRUB's configuration can bypass Secure Boot lockdown restrictions. This is due to insufficient validation of the MMIO base address passed to the GRUB serial command, allowing loading of unsigned GRUB modules while lockdown appears enabled. EPSS 0.1%Vulnerability CWE-822 #ghsa-v555-hf4g-q6pc	CVE Database V5	2026-10-02
Medium	5.3	EPSS 0.4%	CVE-2024-56738GNU GRUB2 · Timing Side Channel Medium5.3EPSS 0.4%2024-12-29CVE Database V5CVE-2024-56738 GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. EPSS 0.4%Vulnerability CWE-208	CVE Database V5	2024-12-29

Page 1 of 1