CVE-2026-6485 | High | 8.2 | 2026-09-09 | UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts. |
CVE-2026-12855 | High | 8.2 | 2026-09-09 | Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects. |
CVE-2021-43614 | Medium | 6.7 | 2026-09-03 | Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure. |
CVE-2021-43613 | Medium | 6.5 | 2026-09-03 | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalat… |
CVE-2021-38489 | High | 8.2 | 2026-09-03 | HDD password plaintext is stored in a UEFI variable. |
CVE-2026-9805 | Low | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. |
CVE-2026-8810 | Medium | 6.9 | 2026-08-19 | On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables. |
CVE-2026-6484 | High | 8.2 | 2026-08-12 | In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution. |
CVE-2025-12053 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-12052 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-12051 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-12050 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-10451 | High | 8.2 | 2025-12-12 | Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption. |
CVE-2025-4410 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitr… |
CVE-2025-4277 | High | 7.5 | 2025-08-13 | Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-4276 | High | 7.5 | 2025-08-13 | UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-4426 | Medium | 6.0 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4425 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4424 | Medium | 6.0 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4423 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4422 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4421 | High | 8.2 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-4275 | High | 7.8 | 2025-06-11 | A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verif… |