Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-21042KEVexploit | 9.8 critical | 36.0% | samsung, android | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. | 8 Oct |
| CVE-2017-7376exploit | 9.8 critical | 23.0% | xmlsoft, google, libxml2, android, debian_linux | Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. | 14 Oct |
| CVE-2026-73296exploit | 9.4 critical | 4.0% | no CPE yet | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8. | Sat 24 Oct |
| CVE-2025-10184exploit ×3 | 8.2 high | 4.0% | no CPE yet | The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers. | 11 Oct |
| CVE-2026-39866exploit ×2 | 7.4 high | 2.0% | lawnchair | Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 patches the issue. | Mon 26 Oct |
| CVE-2026-76036exploit | 9.6 critical | 1.0% | google, chrome | Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Thu 22 Oct |
| CVE-2026-110152exploit | 9.6 critical | 1.0% | google, chrome | Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | 15 Oct |
| CVE-2026-0073exploit ×16 | 8.8 high | 1.0% | google, android | In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation. | Mon 26 Oct |
| CVE-2026-36213exploit ×3 | 7.8 high | 1.0% | no CPE yet | An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component. | Sun 25 Oct |
| CVE-2022-20421exploit ×2 | 7.8 high | 1.0% | google, debian, android, debian_linux | In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel | 14 Oct |
| CVE-2026-18907exploit | 7.5 high | 1.0% | no CPE yet | Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename. | Fri 23 Oct |
| CVE-2025-59489exploit ×2 | 7.4 high | 1.0% | unity, editor | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications. | 8 Oct |
| CVE-2026-7671exploit | 2.9 low | 1.0% | no CPE yet | A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | Mon 26 Oct |
| CVE-2026-0092exploit | 10.0 critical | 0.00% | google, android | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Mon 26 Oct |
| CVE-2026-0163exploit | 9.8 critical | 0.00% | google, android | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Sat 24 Oct |
| CVE-2026-13934exploit | 9.6 critical | 0.00% | google, chrome | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-21055exploit | 8.5 high | 0.00% | no CPE yet | Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege. | Sun 25 Oct |
| CVE-2026-70638exploit | 8.5 high | 0.00% | ggml, llama.cpp | llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding. | Sat 24 Oct |
| CVE-2026-21010exploit | 7.8 high | 0.00% | samsung, android | Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions. | Mon 26 Oct |
| CVE-2025-63895exploit | 7.5 high | 0.00% | jxlindia, jxl_9_inch_car_android_double_din_player_firmware | An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted Link Manager Protocol (LMP) packet. | Tue 27 Oct |
| CVE-2026-39973exploit | 7.1 high | 0.00% | apktool | Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations. | Mon 26 Oct |
| CVE-2026-116106exploit | 6.9 medium | 0.00% | no CPE yet | A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. | Mon 26 Oct |
| CVE-2026-21012exploit | 6.8 medium | 0.00% | samsung, android | External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege. | Mon 26 Oct |
| CVE-2026-21015exploit | 6.8 medium | 0.00% | samsung, android | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier. | Mon 26 Oct |
| CVE-2026-21018exploit ×2 | 6.8 medium | 0.00% | samsung, android | Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code. | Mon 26 Oct |
| CVE-2026-36027exploit | 6.8 medium | 0.00% | no CPE yet | An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (ADB) and Android Debug Bridge components | Sun 25 Oct |
| CVE-2026-116105exploit | 6.3 medium | 0.00% | no CPE yet | A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. | Mon 26 Oct |
| CVE-2026-12960exploit | 6.0 medium | 0.00% | no CPE yet | An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information. | Sun 25 Oct |
| CVE-2026-21011exploit | 5.4 medium | 0.00% | samsung, android | Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock. | Mon 26 Oct |
| CVE-2026-21003exploit | 5.2 medium | 0.00% | samsung, android | Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions. | Mon 26 Oct |
| CVE-2026-21008exploit | 5.1 medium | 0.00% | samsung, android | Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information. | Mon 26 Oct |
| CVE-2026-21016exploit | 5.1 medium | 0.00% | samsung, android | Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21020exploit | 5.1 medium | 0.00% | samsung, android | Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions. | Mon 26 Oct |
| CVE-2026-21006exploit | 4.7 medium | 0.00% | samsung, android | Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents. | Mon 26 Oct |
| CVE-2025-55971exploit | 4.7 medium | 0.00% | tcl, 65c655_firmware | TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains. | 19 Oct |
| CVE-2026-21017exploit | 4.6 medium | 0.00% | samsung, android | Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files. | Mon 26 Oct |
| CVE-2026-21007exploit | 4.4 medium | 0.00% | samsung, android | Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard. | Mon 26 Oct |
| CVE-2026-21009exploit | 4.1 medium | 0.00% | samsung, android | Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning. | Mon 26 Oct |
38 of 38
Download these 38 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 21:20. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.