EUVD-2026-70367

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

CVE-2026-25250 — Updated!

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

PT-2026-84971

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

CVE-2026-80253: Improper Physical Access Control

An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...

QuestStack — Updated!

QuestStack QuestStack is a Meta Quest root and bootloader unlocking project. Using the GhostLock privilege escalation chain and the CVE-2021-1931 ABL/fastboot vulnerability, QuestStack provides a way to gain root access on the latest Quest 1 firmware, temporarily boot using a vulnerable ABL, and...

Multiple vulnerabilities in ShizenBox2

Overview ShizenBox2 provided by Shizen Connect Inc. contains multiple vulnerabilities listed below. Improper physical access control CWE-1263 - CVE-2026-80253 Authorization bypass through user-controlled key CWE-639 - CVE-2026-80254 CVE-2026-80253 Naohide Waguri of PwC Consulting LLC reported thi...

PUB-A-512578404

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508717220

In Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508718527

In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-509578792

In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508718229

In Bootloader, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PT-2026-83365

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.7.6 IGEL OS 11 versions prior to 11.11.150 Description An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsign...

EUVD-2026-57007

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

SUSE CVE-2026-19411

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader...

PT-2026-70961

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-66098

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-66098

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-66098 Mira Hormone Monitor, Mira Android App Missing authentication for critical function

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow...

CVE-2026-28729

Integer overflow in the UEFI firmware for the IntelR Slim Bootloader may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack...

CVE-2026-25194

Out-of-bounds write in the firmware for the IntelR Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are...