Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

sorona.xyz bug bounty programs

tianocore.org Updated

Sorona.xyz runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
9
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program sorona.xyz runs.

  • TianoCore EDK II

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets. 5 excluded.

  • https://www.tianocore.org

    Web

  • Capsule update parsing and the variable services store, the paths by which firmware accepts new code and remembers state across boots

    Products and areas

  • Filesystem and partition parsing, covering FAT, El Torito and GPT, and the FV/FFS firmware-volume parsers that read the flash image itself

    Products and areas

  • Image loading end to end: the PE/COFF loader and the Secure Boot and authenticated-variable verification built on it

    Products and areas

  • OVMF and the virtual platform packages, the open reference target a finding can be demonstrated on without vendor hardware

    Products and areas

  • Reports go in as GitHub Security Advisories under the repository's SECURITY.md, against upstream tianocore/edk2. An OEM or IBV derivative belongs to that vendor, so the boundary is the upstream tree and every package in it

    Products and areas

  • The BaseCryptLib wrapper and the way it consumes OpenSSL or MbedTLS on behalf of every verification path above

    Products and areas

  • The core dispatch phases, PEI and DXE, and the SMM communication buffer boundary where a ring-0 caller crosses into System Management Mode

    Products and areas

  • The network stack in full: the UEFI IPv4 and IPv6, DHCP, TCP, HTTP-boot and iSCSI drivers

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • EDK2 routed as an Intel bounty target: Intel's policy covers only projects 'solely maintained' by Intel, so that is not a second paying route for this code

  • For the Google money specifically, anything reported but never patched upstream, since that pathway pays only on a merge

  • Non-exploitable fuzzer crashes whose fix is a one-liner, which Google explicitly declines to reward on the patch rail

  • OEM and IBV forks such as AMI Aptio, Insyde and Phoenix, where only upstream tianocore/edk2 merges count

  • Patches over twelve months old, which Patch Rewards will not consider

Recent changes

Reward and scope changes across every sorona.xyz program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in sorona.xyz products, from the NVD.

Search NVD
  • CVE-2026-111497 Critical

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie

  • CVE-2025-2486 Low

    The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure

  • CVE-2023-49721 Medium

    An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.

  • CVE-2023-48733 Medium

    An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.

  • CVE-2023-45235 High

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

  • CVE-2023-45236 Medium

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

  • CVE-2023-45237 Medium

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

  • CVE-2023-45229 Medium

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

About this page

This page gathers every public program listed under tianocore.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.