Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-20721 | 7.8 high | 0.00% | mediatek, google, iot_yocto, android | In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279. | 8 Oct |
| CVE-2025-20723 | 7.8 high | 0.00% | google, android | In gnss driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920033; Issue ID: MSV-3797. | 8 Oct |
| CVE-2026-6319 | 7.5 high | 0.00% | google, chrome | Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-6756 | 7.5 high | 0.00% | mozilla, firefox | Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150. | Mon 26 Oct |
| CVE-2026-0136 | 7.5 high | 0.00% | google, android | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0144 | 7.5 high | 0.00% | google, android | In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0156 | 7.5 high | 0.00% | google, android | In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-13283 | 7.5 high | 0.00% | google, chrome | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13856 | 7.5 high | 0.00% | google, chrome | Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14064 | 7.5 high | 0.00% | google, chrome | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14114 | 7.5 high | 0.00% | google, chrome | Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-58299 | 7.5 high | 0.00% | microsoft, edge_chromium | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network. | Sun 25 Oct |
| CVE-2026-16373 | 7.5 high | 0.00% | mozilla, firefox_mobile | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-17698 | 7.5 high | 0.00% | google, chrome | Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17816 | 7.5 high | 0.00% | google, chrome | Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2025-21074 | 7.5 high | 0.00% | samsung, android | Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. | 18 Oct |
| CVE-2025-21075 | 7.5 high | 0.00% | samsung, android | Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. | 18 Oct |
| CVE-2026-103902 | 7.5 high | 0.00% | no CPE yet | Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0. | 16 Oct |
| CVE-2026-95179 | 7.5 high | 0.00% | no CPE yet | An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer. | 16 Oct |
| CVE-2026-8945 | 7.5 high | 0.00% | mozilla, firefox, firefox_focus | Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151. | 14 Oct |
| CVE-2025-9200 | 7.5 high | 0.00% | no CPE yet | The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versions up to, and including, 0.8.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 12 Oct |
| CVE-2025-21055 | 7.5 high | 0.00% | samsung, android | Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory. | 8 Oct |
| CVE-2026-50091 | 7.4 high | 0.00% | aqara, home | Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). | Mon 26 Oct |
| CVE-2026-12348 | 7.4 high | 0.00% | no CPE yet | Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing. | Sun 25 Oct |
| CVE-2026-16404 | 7.4 high | 0.00% | mozilla, firefox_mobile | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-8497 | 7.4 high | 0.00% | devolutions, password_manager | Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate. | Sat 24 Oct |
| CVE-2026-33045 | 7.3 high | 0.00% | home-assistant | Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable cross-site scripting, similar to CVE-2025-62172. Version 2026.01 fixes the issue. | Mon 26 Oct |
| CVE-2026-0131 | 7.3 high | 0.00% | google, android | In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. | Sun 25 Oct |
| CVE-2026-70640 | 7.3 high | 0.00% | ggml, llama.cpp | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution. | Sat 24 Oct |
| CVE-2025-21058 | 7.3 high | 0.00% | no CPE yet | Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attackers to potentially execute arbitrary code with SystemUI privilege. | 8 Oct |
| CVE-2026-54318 | 7.1 high | 0.00% | home-assistant, home_assistant_companion | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services LocationResult directly to it; the receiver trusts the extra and forwards it to the user's Home Assistant server as the device's real location. This bypasses Android's developer-mode "Mock Location" gate and allows a local malicious app to drive zone-based automations (unlock door / disarm alarm / open garage) by faking the user's GPS position. This vulnerability is fixed in 2026.5.3. | Sun 25 Oct |
| CVE-2026-17741 | 7.1 high | 0.00% | google, chrome | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | Sat 24 Oct |
| CVE-2026-66310 | 7.1 high | 0.00% | microsoft, edge | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. | Fri 23 Oct |
| CVE-2026-88964 | 7.1 high | 0.00% | no CPE yet | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options | 15 Oct |
| CVE-2026-106188 | 7.1 high | 0.00% | google, chrome | Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium) | 8 Oct |
| CVE-2026-114356 | 7.0 high | 0.00% | no CPE yet | Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check. | 15 h ago |
| CVE-2026-114353 | 7.0 high | 0.00% | no CPE yet | Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system(). | 15 h ago |
| CVE-2026-0125 | 7.0 high | 0.00% | google, android | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-21064 | 7.0 high | 0.00% | samsung, android | Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. | Fri 23 Oct |
| CVE-2026-107153 | 7.0 high | 0.00% | no CPE yet | Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed. | 15 Oct |
| CVE-2022-20422 | 7.0 high | 0.00% | google, debian, android, debian_linux | In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237540956References: Upstream kernel | 14 Oct |
| CVE-2026-114044 | 6.9 medium | 0.00% | no CPE yet | FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions, causing android_UpdateWindowFromSurface to copy heap memory beyond the allocation, leading to crashes or memory disclosure. | 20 h ago |
| CVE-2026-3291 | 6.9 medium | 0.00% | hp, samsung_print_service_plugin | Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities. | Mon 26 Oct |
| CVE-2026-21022 | 6.9 medium | 0.00% | samsung, android | Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21025 | 6.9 medium | 0.00% | samsung, android | Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21032 | 6.9 medium | 0.00% | samsung, assistant | Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script. | Mon 26 Oct |
| CVE-2026-21033 | 6.9 medium | 0.00% | samsung, assistant | Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script. | Mon 26 Oct |
| CVE-2026-21023 | 6.9 medium | 0.00% | samsung, android | Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application. | Mon 26 Oct |
| CVE-2026-21054 | 6.9 medium | 0.00% | no CPE yet | Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data. | Sun 25 Oct |
| CVE-2026-21058 | 6.9 medium | 0.00% | samsung, android | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Fri 23 Oct |
Download these 564 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.