Security advisory page:

If you wish to report a security issue to the community, please refer to the process found on the UEFI Forum’s Security Response located at: http://uefi.org/security.

Do not send unencrypted security related reports on the EDK2 alias.

In your report please include the paths of the modules you believe are involved and a detailed description of the issue. The UEFI Forum will review your email and direct to the relevant tianocore module owners and architects, who may reply with confirmation and may also continue the thread if they have follow up questions or information.

List of current EDK II Security Advisory logs: V .002 Download PDF