Know what changed.
Trace why it matters.

CVE-2026-97631 is a CVSS 9.5 vulnerability in TianoCore EDK II, used by hardware manufacturers, cloud providers and major UEFI vendors including AMI, Insyde and Phoenix. The flaw is a buffer overflow in the PXE-Base Code driver, which handles network booting and ICMP errors without enforcing a 504-byte copy limit.

Successful exploitation could provide ring-0 execution, bypass attestation, and help turn limited network access into full control; invalid input can also stop booting and cause denial of service.

CVE-2026-111497 is described as a remotely exploitable out-of-bounds write vulnerability in Brotli, a widely used open-source compression library. The article states that an attacker can supply Brotli data that an application decompresses with Node.js’s node:zlib module, potentially corrupting process memory.

The source says the vulnerability puts a broad range of software at risk and may lead to a crash or disclosure of process data; the supplied text truncates the remainder of the impact description.

Adobe released patches for eight critical security flaws in Campaign Classic; successful exploitation could result in arbitrary code execution, security feature bypass, or privilege escalation. CVE-2026-104351 has a CVSS score of 9.9 and is a code-injection vulnerability that could lead to arbitrary code execution.

This belongs in a priority queue because the advisory describes several materially different security outcomes.