EUVD-2026-73603

Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

CVE-2026-20293 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

EUVD-2026-72936

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

CVE-2026-20293

A vulnerability in the UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances allows bypassing UEFI Secure Boot validation checks. The root cause is the availability of memory write commands in the UEFI Shell while Secure Boot is enabled. An attacker—authenticated with user or ad...

CVE-2026-20293 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

CVE-2026-33197 BDS Module Bypass Secure Boot Advisory

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability...

CVE-2026-33197 BDS Module Bypass Secure Boot Advisory

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability...

CVE-2026-33197

AMI APTIOV BIOS contains a vulnerability in the BDS Module (Secure Boot) where an incomplete list of disallowed inputs allows a privileged local user to bypass Secure Boot and achieve arbitrary code execution . The CVSS v4.0 score is 8.7 (HIGH) , with low attack complexity, high privileges requir...

Windows Secure Boot Security Feature Bypass Vulnerability

Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to...

PT-2026-87141

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

PT-2026-87673

Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

CVE-2026-20293: Exposed Dangerous Method or Function

A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access t...

CVE-2026-69713: Dependency on Vulnerable Third-Party Component

Dependency on vulnerable third-party component in Windows Secure Boot allows an authorized attacker to bypass a security feature locally...

secureboot_objects v1.7.0-signed

Secure Boot Objects This repository is used to hold the secure boot objects recommended by Microsoft. For documentation visit our Wiki! Versioning This repository follows semantic versioning .., which is a versioning scheme that conveys meaning about the underlying changes. Version Components Maj...

CVE-2026-25250 — Updated!

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

CVE-2025-4275 — Updated!

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing This repository contains research material related to CVE-2025-4275, a Secure Boot bypass vulnerability affecting UEFI-compatible firmware based on Insyde H2O. It centralizes technical analysis of the vulnerability, the binaries...

CVE-2025-3052 — Updated!

🐞 CVE-2025-3052: IhisiParamBuffer Memory Corruption This repository centralizes research material related to CVE-2025-3052, a memory corruption vulnerability in a UEFI module signed with Microsoft's third-party certificate that allows an attacker to corrupt security-critical firmware structures,...

EUVD-2026-67962

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...