Tianocore edk2

Name: Tianocore edk2
Brand: Tianocore

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical18high6medium0low

updated 2026-10-24

vulnerabilities (35)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2018-12178US	critical9.1	2.27% (83rd)	—	no fix	2019-03-27	—
CVE-2018-12180US	high8.8	2.25% (83rd)	—	no fix	2019-03-27	—
CVE-2023-45233US	high7.5	2.08% (81st)	—	no fix	2024-01-16	2 versions
CVE-2023-45232US	high7.5	2.08% (81st)	—	no fix	2024-01-16	2 versions
CVE-2021-38575US	high8.1	1.99% (81st)	—	no fix	2021-12-01	14 versions
CVE-2019-14553US	medium4.9	1.36% (71st)	—	no fix	2020-11-23	≤ 20190828.37eef910
CVE-2023-45235US	high8.8	1.22% (69th)	—	no fix	2024-01-16	2 versions
CVE-2023-45230US	high8.8	1.21% (68th)	—	no fix	2024-01-16	2 versions
CVE-2023-45234US	high8.8	1.19% (68th)	—	no fix	2024-01-16	2 versions
CVE-2021-38576US	high7.5	1.17% (67th)	—	no fix	2022-01-03	≤ 202111
CVE-2021-28213US	high7.5	1.11% (66th)	—	no fix	2021-06-11	≤ 201905
CVE-2021-38578US	critical9.8	1.02% (63rd)	—	no fix	2022-03-03	≤ 202202
CVE-2023-45237US	high7.5	0.99% (62nd)	—	no fix	2024-01-16	2 versions
CVE-2023-45236US	high7.5	0.99% (62nd)	—	no fix	2024-01-16	2 versions
CVE-2023-45229US	medium6.5	0.94% (60th)	—	no fix	2024-01-16	2 versions
CVE-2023-45231US	medium6.5	0.85% (58th)	—	no fix	2024-01-16	2 versions
CVE-2025-2296US	—	0.77% (55th)	—	202505	2025-12-09	2 versions
CVE-2021-28216US	high7.8	0.42% (36th)	—	no fix	2021-08-05	≤ 202111-rc1
CVE-2018-12179US	high7.8	0.42% (35th)	—	no fix	2019-03-27	≤ 20190606.20d2e5a1
CVE-2014-8271US	medium6.8	0.40% (34th)	—	no fix	2020-02-06	≤ before SVN 16280
CVE-2021-28210US	high7.8	0.40% (33rd)	—	no fix	2021-06-11	≤ 202008
CVE-2021-28211US	medium6.7	0.39% (31st)	—	no fix	2021-06-11	≤ 202008
CVE-2024-38796US	—	0.37% (30th)	—	202408	2024-09-27	3 versions
CVE-2019-11098US	medium6.8	0.34% (27th)	—	no fix	2021-07-14	≤ 2020.11-5
CVE-2019-14584US	high7.8	0.33% (24th)	—	no fix	2021-06-03	≤ 2020-10-21
CVE-2022-36763US	high7.8	0.29% (21st)	—	no fix	2024-01-09	2 versions
CVE-2022-36765US	high7.8	0.29% (20th)	—	no fix	2024-01-09	2 versions
CVE-2022-36764US	high7.8	0.29% (20th)	—	no fix	2024-01-09	2 versions
CVE-2023-48733US	—OT elevated	0.26% (16th)	—	no fix	2024-02-14	≤ 2024.02-2
CVE-2025-2295US	—	0.24% (15th)	—	no fix	2025-03-14	2 versions
CVE-2024-1298US	—	0.22% (12th)	—	edk2-stable202405	2024-05-30	3 versions
CVE-2024-38797US	—	0.21% (11th)	—	no fix	2025-04-07	2 versions
CVE-2024-38805US	—	0.21% (11th)	—	no fix	2025-08-12	≤ 202508
CVE-2025-3770US	—	0.15% (4th)	—	no fix	2025-08-07	2 versions
CVE-2024-38798US	—	0.14% (3rd)	—	edk2-stable202511	2025-12-09	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer8 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')5 CVEs
CWE-125Out-of-bounds Read5 CVEs
CWE-122Heap-based Buffer Overflow4 CVEs
CWE-680Integer Overflow to Buffer Overflow3 CVEs
CWE-787Out-of-bounds Write3 CVEs
CWE-124Buffer Underwrite ('Buffer Underflow')2 CVEs
CWE-190Integer Overflow or Wraparound2 CVEs

sources (3)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)32 CVEs
EUEU Vulnerability Database (ENISA)17 CVEs
DECERT-Bund (BSI CSAF)8 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan