CVE Program partner

Insyde

Insyde Software

API
CVEs, 365 days1324 all time, 1 rejected
Quality97%median 99%
CVSS by the CNA100%share of records
CWE92%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationInsyde Software
RoleCNA
TypeVendor, Researcher
Reports tomitre
ScopeVulnerabilities in all of Insyde Software’s firmware and software products, as well as vulnerabilities discovered by Insyde Software that are not covered by another CNA’s scope.
Advisorieshttps://www.insyde.com/security-pledge/

Latest CVEs · RSS

  • CVE-2026-12855 2026-09-09 · CVSS 8.2
    Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
  • CVE-2026-6485 2026-09-09 · CVSS 8.2
    UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.
  • CVE-2021-38489 2026-09-03 · CVSS 8.2
    HDD password plaintext is stored in a UEFI variable.
  • CVE-2021-43614 2026-09-03 · CVSS 6.7
    Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.
  • CVE-2021-43613 2026-09-03 · CVSS 6.5
    An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalati
  • CVE-2026-9805 2026-08-26 · CVSS 2.7
    SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.
  • CVE-2026-8810 2026-08-19 · CVSS 6.9
    On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.
  • CVE-2026-6484 2026-08-12 · CVSS 8.2
    In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
  • CVE-2025-12053 2026-01-14 · CVSS 7.8
    The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a
  • CVE-2025-12052 2026-01-14 · CVSS 7.8
    The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a
  • CVE-2025-12051 2026-01-14 · CVSS 7.8
    The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a
  • CVE-2025-12050 2026-01-14 · CVSS 7.8
    The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a
  • CVE-2025-10451 2025-12-12 · CVSS 8.2
    Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.
  • CVE-2025-4410 2025-08-13 · CVSS 7.5
    A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitra
  • CVE-2025-4277 2025-08-13 · CVSS 7.5
    Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
  • CVE-2025-4276 2025-08-13 · CVSS 7.5
    UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
  • CVE-2025-4426 2025-07-30 · CVSS 6.0
    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for
  • CVE-2025-4425 2025-07-30 · CVSS 8.2
    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for
  • CVE-2025-4424 2025-07-30 · CVSS 6.0
    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for
  • CVE-2025-4423 2025-07-30 · CVSS 8.2
    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for
  • CVE-2025-4422 2025-07-30 · CVSS 8.2
    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for
  • CVE-2025-4421 2025-07-30 · CVSS 8.2
    The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for
  • CVE-2025-4275 2025-06-11 · CVSS 7.8
    A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verifi

All CVE Program partners