Vendor
TianoCore
54 known vulnerabilities in products by TianoCore, 1 of them actively exploited (CISA KEV).
Key figures
54
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder In CISA KEValso in 18 other products | 8.1 | |
| Critical | CVE-2018-12178 | TianoCore EDK II: Buffer Overflow | 9.1 | |
| High | CVE-2018-12180 | TianoCore EDK II: Buffer Overflow | 8.8 | |
| Critical | CVE-2026-97631 | Pre-boot RCE in EDK II PXE driver | — | |
| High | CVE-2023-45233 | Infinite loop in EDK II Network Package | 7.5 | |
| High | CVE-2023-45232 | Infinite loop in EDK II Network Package | 7.5 | |
| High | CVE-2021-38575 | TianoCore EDK II: Buffer Underflow | 8.1 | |
| Critical | CVE-2019-0160 | TianoCore EDK II: Classic Buffer Overflow | 8.7 | |
| High | CVE-2023-45235 | Buffer Overflow in EDK II Network Package | 8.3 | |
| High | CVE-2023-45230 | Buffer Overflow in EDK II Network Package | 8.3 | |
| High | CVE-2023-45234 | Buffer Overflow in EDK II Network Package | 8.3 | |
| High | CVE-2025-2296 | Un-verified kernel bypass Secure Boot mechanism in direct boot mode | 8.2 | |
| High | CVE-2019-14559 | Extensible Firmware Interface Development Kit (EDK II): Denial of Service | 7.5 | |
| High | CVE-2021-38576 | EDK II: security vulnerability | 7.5 | |
| High | CVE-2021-28213 | TianoCore EDK II: security vulnerability | 7.5 | |
| Critical | CVE-2021-38578 | TianoCore EDK II: Buffer Underflow | 7.4 | |
| Medium | CVE-2023-45229 | Out-of-Bounds Read in EDK II Network Package | 6.5 | |
| Medium | CVE-2019-14553 | Extensible Firmware Interface Development Kit (EDK II): Improper Authentication | 4.9 | |
| High | CVE-2023-45236 | Predictable TCP ISNs in EDK II Network Package | 5.8 | |
| Medium | CVE-2024-38796 | Integer overflow in PeCoffLoaderRelocateImage | 5.9 | |
| High | CVE-2019-14586 | Extensible Firmware Interface Development Kit (EDK II): Use-After-Free | 8.0 | |
| Medium | CVE-2023-45231 | Out-of-Bounds Read in EDK II Network Package | 6.5 | |
| High | CVE-2023-45237 | Use of a Weak PseudoRandom Number Generator in EDK II Network Package | 5.3 | |
| High | CVE-2025-2486 | UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu | 8.8 | |
| Medium | CVE-2019-14587 | Extensible Firmware Interface Development Kit (EDK II): Denial of Service | 6.5 |
News
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026cisco-psirt,
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergesthehackernews,
- Node2Shell puts Microsoft and Node.js on Brotli patch dutycsoonline,
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawthehackernews,
- Node2Shell CVEsfortinet-psirt,
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Softwarethehackernews,
Products
| TianoCore EDK2 | 43 | 1 |
| TianoCore EDK II | 17 | 0 |