BaselineWatch
58796 CVEs · 135 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,796 New, 24 h660 Changed, 24 h827 In KEV135 Public exploit1,592 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-58306 6.1 medium 0.00% no CPE yet Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98. Sun 25 Oct
CVE-2026-58307 6.1 medium 0.00% no CPE yet Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c. Sun 25 Oct
CVE-2026-21134 6.1 medium 0.00% no CPE yet Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. 16 Oct
CVE-2026-21061 6.0 medium 0.00% samsung, android Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability. Fri 23 Oct
CVE-2026-21132 6.0 medium 0.00% no CPE yet Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability. 15 Oct
CVE-2026-21038 5.9 medium 0.00% samsung, android_usb_driver Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds memory. Mon 26 Oct
CVE-2026-14160 5.9 medium 0.00% no CPE yet Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d. Sun 25 Oct
CVE-2026-21135 5.9 medium 0.00% no CPE yet Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. 16 Oct
CVE-2023-21435 5.5 medium 0.00% samsung, android Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log. Wed 28 Oct
CVE-2023-53687 5.5 medium 0.00% linux, linux_kernel In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk When the best clk is searched, we iterate over all possible clk. If we find a better match, the previous one, if any, needs to be freed. If a better match has already been found, we still need to free the new one, otherwise it leaks. Wed 28 Oct
CVE-2026-6840 5.5 medium 0.00% samsung, one Missing bounds validation for operator could allow out of range operator-code lookup during model loading Affected version is prior to commit 1.30.0. Mon 26 Oct
CVE-2026-15551 5.5 medium 0.00% samsung, rlottie Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects . Sat 24 Oct
CVE-2025-21076 5.5 medium 0.00% samsung, account Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Account. User interaction is required for triggering this vulnerability. 18 Oct
CVE-2026-108978 5.5 medium 0.00% no CPE yet Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9. 16 Oct
CVE-2024-40916 5.5 medium 0.00% linux, linux_kernel In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variants of the Exynos HDMI (like the one in Exynos4 SoCs) are not able to drive such mode, so report a safe 640x480 mode instead of nothing in case of the EDID reading failure. This fixes the following issue observed on Trats2 board since commit 13d5b040363c ("drm/exynos: do not return negative values from .get_modes()"): [drm] Exynos DRM: using 11c00000.fimd device for DMA mapping operations exynos-drm exynos-drm: bound 11c00000.fimd (ops fimd_component_ops) exynos-drm exynos-drm: bound 12c10000.mixer (ops mixer_component_ops) exynos-dsi 11c80000.dsi: [drm:samsung_dsim_host_attach] Attached s6e8aa0 device (lanes:4 bpp:24 mode-flags:0x10b) exynos-drm exynos-drm: bound 11c80000.dsi (ops exynos_dsi_component_ops) exynos-drm exynos-drm: bound 12d00000.hdmi (ops hdmi_component_ops) [drm] Initialized exynos 1.1.0 20180330 for exynos-drm on minor 1 exynos-hdmi 12d00000.hdmi: [drm:hdmiphy_enable.part.0] *ERROR* PLL could not reach steady state panel-samsung-s6e8aa0 11c80000.dsi.0: ID: 0xa2, 0x20, 0x8c exynos-mixer 12c10000.mixer: timeout waiting for VSYNC ------------[ cut here ]------------ WARNING: CPU: 1 PID: 11 at drivers/gpu/drm/drm_atomic_helper.c:1682 drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 [CRTC:70:crtc-1] vblank wait timed out Modules linked in: CPU: 1 PID: 11 Comm: kworker/u16:0 Not tainted 6.9.0-rc5-next-20240424 #14913 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound deferred_probe_work_func Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x68/0x88 dump_stack_lvl from __warn+0x7c/0x1c4 __warn from warn_slowpath_fmt+0x11c/0x1a8 warn_slowpath_fmt from drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 drm_atomic_helper_wait_for_vblanks.part.0 from drm_atomic_helper_commit_tail_rpm+0x7c/0x8c drm_atomic_helper_commit_tail_rpm from commit_tail+0x9c/0x184 commit_tail from drm_atomic_helper_commit+0x168/0x190 drm_atomic_helper_commit from drm_atomic_commit+0xb4/0xe0 drm_atomic_commit from drm_client_modeset_commit_atomic+0x23c/0x27c drm_client_modeset_commit_atomic from drm_client_modeset_commit_locked+0x60/0x1cc drm_client_modeset_commit_locked from drm_client_modeset_commit+0x24/0x40 drm_client_modeset_commit from __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0xc4 __drm_fb_helper_restore_fbdev_mode_unlocked from drm_fb_helper_set_par+0x2c/0x3c drm_fb_helper_set_par from fbcon_init+0x3d8/0x550 fbcon_init from visual_init+0xc0/0x108 visual_init from do_bind_con_driver+0x1b8/0x3a4 do_bind_con_driver from do_take_over_console+0x140/0x1ec do_take_over_console from do_fbcon_takeover+0x70/0xd0 do_fbcon_takeover from fbcon_fb_registered+0x19c/0x1ac fbcon_fb_registered from register_framebuffer+0x190/0x21c register_framebuffer from __drm_fb_helper_initial_config_and_unlock+0x350/0x574 __drm_fb_helper_initial_config_and_unlock from exynos_drm_fbdev_client_hotplug+0x6c/0xb0 exynos_drm_fbdev_client_hotplug from drm_client_register+0x58/0x94 drm_client_register from exynos_drm_bind+0x160/0x190 exynos_drm_bind from try_to_bring_up_aggregate_device+0x200/0x2d8 try_to_bring_up_aggregate_device from __component_add+0xb0/0x170 __component_add from mixer_probe+0x74/0xcc mixer_probe from platform_probe+0x5c/0xb8 platform_probe from really_probe+0xe0/0x3d8 really_probe from __driver_probe_device+0x9c/0x1e4 __driver_probe_device from driver_probe_device+0x30/0xc0 driver_probe_device from __device_attach_driver+0xa8/0x120 __device_attach_driver from bus_for_each_drv+0x80/0xcc bus_for_each_drv from __device_attach+0xac/0x1fc __device_attach from bus_probe_device+0x8c/0x90 bus_probe_device from deferred_probe_work_func+0 ---truncated--- 15 Oct
CVE-2025-21045 5.5 medium 0.00% samsung, wear_os Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. 8 Oct
CVE-2025-21049 5.5 medium 0.00% samsung, android Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability. 8 Oct
CVE-2025-21050 5.5 medium 0.00% samsung, android Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles. 8 Oct
CVE-2025-21054 5.5 medium 0.00% samsung, android Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory. 8 Oct
CVE-2025-21059 5.5 medium 0.00% samsung, health Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health. 8 Oct
CVE-2025-21060 5.5 medium 0.00% samsung, smart_switch Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from applications. User interaction is required for triggering this vulnerability. 8 Oct
CVE-2025-21061 5.5 medium 0.00% samsung, smart_switch Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is required for triggering this vulnerability. 8 Oct
CVE-2025-21070 5.5 medium 0.00% samsung, notes Out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory. 8 Oct
CVE-2026-118435 5.4 medium 0.00% no CPE yet Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation. Wed 28 Oct
CVE-2026-40448 5.3 medium 0.00% samsung, one Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE. Affected version is prior to commit 1.30.0. Mon 26 Oct
CVE-2026-21031 5.2 medium 0.00% samsung, android Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability. Mon 26 Oct
CVE-2026-21073 5.2 medium 0.00% samsung, android Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity. Fri 23 Oct
CVE-2026-21021 5.1 medium 0.00% samsung, android Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity. Mon 26 Oct
CVE-2026-21028 5.1 medium 0.00% samsung, android Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. Mon 26 Oct
CVE-2026-21053 5.1 medium 0.00% no CPE yet Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox. Sun 25 Oct
CVE-2026-21066 5.1 medium 0.00% samsung, android Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. Fri 23 Oct
CVE-2026-21067 5.1 medium 0.00% samsung, android Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. Fri 23 Oct
CVE-2026-21069 5.1 medium 0.00% samsung, android Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. Fri 23 Oct
CVE-2026-21070 5.1 medium 0.00% samsung, android Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. Fri 23 Oct
CVE-2026-21071 5.1 medium 0.00% samsung, android Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. Fri 23 Oct
CVE-2026-21072 5.1 medium 0.00% samsung, android Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. Fri 23 Oct
CVE-2026-21133 5.1 medium 0.00% no CPE yet Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. 16 Oct
CVE-2026-21130 5.1 medium 0.00% no CPE yet Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. 15 Oct
CVE-2026-21129 5.1 medium 0.00% no CPE yet Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges. 15 Oct
CVE-2026-21128 5.1 medium 0.00% no CPE yet Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges. 15 Oct
CVE-2026-21027 4.8 medium 0.00% samsung, android Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function. Mon 26 Oct
CVE-2026-21034 4.8 medium 0.00% samsung, auto Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to change audio configuration. Mon 26 Oct
CVE-2026-21056 4.8 medium 0.00% no CPE yet Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information. Sun 25 Oct
CVE-2026-21065 4.8 medium 0.00% samsung, android Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. Fri 23 Oct
CVE-2026-21062 4.8 medium 0.00% samsung, android Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data. Fri 23 Oct
CVE-2026-21078 4.7 medium 0.00% samsung, smart_switch Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity. Fri 23 Oct
CVE-2025-21063 4.6 medium 0.00% samsung, voice_recorder Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical attackers to access recording files on the lock screen. 8 Oct
CVE-2025-21071 4.4 medium 0.00% samsung, android Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. 18 Oct
CVE-2026-110933 4.4 medium 0.00% no CPE yet Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7. 15 Oct
CVE-2026-110934 4.4 medium 0.00% no CPE yet Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa. 15 Oct

150 of 163 · Next · Previous

Download these 163 as CSV · subscribe to this list.

EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.