There are 4 open security issues in bullseye.
4 issues left for the package maintainer to handle:
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.
BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.
You can find information about how to handle these issues in the security team's documentation.
1 issue that should be fixed with the next stable update:
Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.