CVE-2025-51746

CVE-2025-51746 affects jishenghua JSH_ERP 2.3.1. The vulnerability is in the /serialNumber/addSerialNumber endpoint and arises from fastjson deserialization, with CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, CRITICAL). Exploitation details are not provided in the connected docu...

CVE-2025-51746

An issue was discovered in jishenghua JSHERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

Schneider Electric PowerChute Serial Shutdown Installed (Windows)

Binary data schneiderelectricpowerchuteserialshutdown.nbin...

PT-2025-48085

An issue was discovered in jishenghua JSH ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks...

The vulnerability of the spi_add_device() function in the drivers/spi/spi.c module of the Linux kernel’s SPI device support driver allows a attacker to cause a service failure.

The vulnerability of the spiadddevice function in the drivers/spi/spi.c module of the Linux kernel’s SPI device support driver relates to improper locking of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

Grub2: grub2: out-of-bounds write via malicious usb device

...

PT-2026-2505

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the fsl-cpm driver within the Linux kernel related to handling transfer sizes during SPI communication. A commit intended to optimize large transfers by switching to...

TencentOS Server 4: kernel (TSSA-2025:0047)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0047 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwis...

EUVD-2025-198081

A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a malicious...

DEBIAN-CVE-2025-61661

A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a malicious...

UBUNTU-CVE-2025-61661

A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a malicious...

CVE-2025-61661

CVE-2025-61661 affects the GRUB2 bootloader. The vulnerability stems from the USB string conversion handling, allowing a local attacker with a malicious USB device connected during boot to trigger inconsistent length values, potentially crashing GRUB (DoS) and possibly causing data corruption (im...

CVE-2025-61661 Grub2: grub2: out-of-bounds write via malicious usb device

A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a malicious...

CVE-2025-61661

A vulnerability has been identified in the GRUB Grand Unified Bootloader component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a malicious...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS Advisories. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-322-01 Schneider Electric EcoStruxure Machine SCADA Expert & Pro-face BLUE Open Studio ICSA-25-322-02 Shel...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-56531)

ALSA: caiaq: OTOH, the current code uses sndcardfree at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. This plugin only works with Tenable.ot. Please visit...

Siemens SIPROTEC 5 Allocation of Resources Without Limits or Throttling (CVE-2025-40570)

Affected devices do not properly limit the bandwidth for incoming network packets over their local USB port. This could allow an attacker with physical access to send specially crafted packets with high bandwidth to the affected devices thus forcing them to exhaust their memory and stop respondin...

PT-2025-47379

Name of the Vulnerable Software and Affected Versions GRUB affected versions not specified Description A flaw exists in the GRUB bootloader due to improper handling of string conversion when processing information from a USB device. Specifically, the bootloader is susceptible to inconsistent leng...

GNU GRUB 安全漏洞

GNU GRUB is a Linux system boot program from the GNU community. A security vulnerability exists in GNU GRUB that stems from improper handling of USB device string conversion, which could result in a denial of service or data corruption...