Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-21059 | 6.9 medium | 0.00% | samsung, android | Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Fri 23 Oct |
| CVE-2026-11319 | 6.9 medium | 0.00% | no CPE yet | TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges. | 22 Oct |
| CVE-2026-53986 | 6.9 medium | 0.00% | no CPE yet | Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password. | 22 Oct |
| CVE-2026-21127 | 6.9 medium | 0.00% | no CPE yet | Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. | 16 Oct |
| CVE-2025-12080 | 6.9 medium | 0.00% | no CPE yet | On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents utilizing the sms:, smsto:, mms:, and mmsto: Uniform Resource Identifier (URI) schemes is incorrectly implemented. Due to this misconfiguration, an attacker capable of invoking an Android intent can exploit this vulnerability to send messages on the user’s behalf to arbitrary receivers without requiring any further user interaction or specific permissions. This allows for the silent and unauthorized transmission of messages from a compromised Wear OS device. | 8 Oct |
| CVE-2026-118609 | 6.8 medium | 0.00% | no CPE yet | Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto connection handler. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29016. | Wed 28 Oct |
| CVE-2026-21029 | 6.8 medium | 0.00% | samsung, android | Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations. | Mon 26 Oct |
| CVE-2026-13282 | 6.8 medium | 0.00% | google, chrome | Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corruption via physical access to the device. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-57848 | 6.8 medium | 0.00% | no CPE yet | Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filter the incoming URI before using it as the outgoing attachment, so a caller can pass a file:// URI pointing at the application's own internal storage (for example /data/data/chat.revolt/databases/revolt.db, cached authentication token files, or preferences) and have the app treat that internal file as a user-selected attachment. An attacker who can invoke intents on the victim's device (via ADB access, a co-installed malicious application, or any other route that reaches Android's intent dispatch) can launch ShareTargetActivity with such a URI and cause the victim, on a single channel-selection interaction, to send the internal file to any Stoat channel or user of the attacker's choosing. The composer displays the attachment as \"attachment\" with no filename indication, so the victim has no visible signal that the file being sent is their own internal application data. Consequences include disclosure of the local Stoat database (message history, contact list, cached content), disclosure of authentication tokens permitting full account takeover, and disclosure of any other file readable by the app process. | Sat 24 Oct |
| CVE-2026-70639 | 6.8 medium | 0.00% | ggml, llama.cpp | llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service. | Sat 24 Oct |
| CVE-2026-21063 | 6.8 medium | 0.00% | samsung, android | Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function. | Fri 23 Oct |
| CVE-2025-21047 | 6.8 medium | 0.00% | samsung, android | Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs. | 8 Oct |
| CVE-2023-20627 | 6.7 medium | 0.00% | google, android | In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629585; Issue ID: ALPS07629585. | Wed 28 Oct |
| CVE-2026-21060 | 6.7 medium | 0.00% | samsung, android | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles. | Fri 23 Oct |
| CVE-2025-20746 | 6.7 medium | 0.00% | linuxfoundation, rdkcentral, yocto, rdk-b, android | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967. | 18 Oct |
| CVE-2025-20747 | 6.7 medium | 0.00% | linuxfoundation, rdkcentral, yocto, rdk-b, android | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966. | 18 Oct |
| CVE-2025-20749 | 6.7 medium | 0.00% | google, android | In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915493; Issue ID: MSV-3800. | 18 Oct |
| CVE-2026-25270 | 6.7 medium | 0.00% | qualcomm, snapdragon_g1_gen_2_gaming_platform_firmware, cologne_firmware, congo_firmware | Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. | 9 Oct |
| CVE-2022-20153 | 6.7 medium | 0.00% | google, android | In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222091980References: Upstream kernel | 8 Oct |
| CVE-2026-113224 | 6.5 medium | 0.00% | google, chrome | Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-0127 | 6.5 medium | 0.00% | google, android | In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-0128 | 6.5 medium | 0.00% | google, android | In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | Sun 25 Oct |
| CVE-2026-0165 | 6.5 medium | 0.00% | google, android | In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | Sun 25 Oct |
| CVE-2026-13826 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13866 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13868 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13887 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13910 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13923 | 6.5 medium | 0.00% | google, chrome | Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13924 | 6.5 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13932 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13936 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13943 | 6.5 medium | 0.00% | google, chrome | Uninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13949 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13954 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13964 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14008 | 6.5 medium | 0.00% | google, chrome | Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13816 | 6.5 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-13822 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High) | Sun 25 Oct |
| CVE-2026-14088 | 6.5 medium | 0.00% | google, chrome | Uninitialized Use in Canvas in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14096 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-16397 | 6.5 medium | 0.00% | mozilla, firefox | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. | Sat 24 Oct |
| CVE-2026-17690 | 6.5 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | Sat 24 Oct |
| CVE-2026-17793 | 6.5 medium | 0.00% | google, chrome | Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-17805 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-17825 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-18809 | 6.5 medium | 0.00% | no CPE yet | Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3. | Fri 23 Oct |
| CVE-2026-17953 | 6.5 medium | 0.00% | google, chrome | Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | Fri 23 Oct |
| CVE-2026-17968 | 6.5 medium | 0.00% | google, chrome | Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) | Fri 23 Oct |
| CVE-2026-17999 | 6.5 medium | 0.00% | google, chrome | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) | Fri 23 Oct |
Download these 566 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.