SUSE CVE-2023-43758

Improper input validation in UEFI firmware for some IntelR processors may allow a privileged user to potentially enable escalation of privilege via local access...

SUSE CVE-2024-28127

Improper input validation in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

SUSE CVE-2024-29214

Improper input validation in UEFI firmware CseVariableStorageSmm for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

SUSE SLES15 Security Update : ovmf (SUSE-SU-2026:0213-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0213-1 advisory. - CVE-2022-36765: Fixed integer overflow to buffer overflow via local network vulnerability bsc1218680. Tenable has extracted the preceding...

SUSE SLES15 Security Update : ovmf (SUSE-SU-2026:0212-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0212-1 advisory. - CVE-2022-36765: Fixed integer overflow to buffer overflow via local network vulnerability bsc1218680. Tenable has extracted the preceding...

SUSE SLES12 Security Update : ovmf (SUSE-SU-2026:0121-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0121-1 advisory. - CVE-2022-36765: Fixed integer overflow to buffer overflow via local network vulnerability bsc1218680. Tenable has extracted the preceding description...

Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a new EFI/UEFI specification from Insyde, China. It is intended to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O, which stems from a buffer overflow that can be caused by untrusted user-mode applications when readin...

CVE-2026-21265

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes...

UBUNTU-CVE-2026-21265

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes...

MiracleLinux 9 : microcode_ctl-20250211-1.el9_6 (AXSA:2025-10063:04)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2025-10063:04 advisory. microcodectl: Improper input validation in UEFI firmware CVE-2024-28047 microcodectl: Insufficient granularity of access control in UEFI firmware...

CVE-2023-25546

Out-of-bounds read in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable denial of service via local access...

CVE-2021-33115

Improper input validation for some IntelR PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2021-0071

Improper input validation in firmware for some IntelR PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2022-35897

An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally...

CVE-2019-18913

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP...

CVE-2024-39707

Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version...

CVE-2023-49721

An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot...

CVE-2024-39285

Improper access control in UEFI firmware in some IntelR Server M20NTP Family may allow a privileged user to potentially enable information disclosure via local access...

CVE-2023-43626

Improper access control in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

EUVD-2026-1670

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the application checks the validity of the username but appears to skip, misinterpret, or incorrectly validate the password when the provided username matches a...