Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-21065 | 4.8 medium | 0.00% | samsung, android | Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | Fri 23 Oct |
| CVE-2026-21062 | 4.8 medium | 0.00% | samsung, android | Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data. | Fri 23 Oct |
| CVE-2026-78196 | 4.8 medium | 0.00% | no CPE yet | A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded. | 12 Oct |
| CVE-2025-66270 | 4.7 medium | 0.00% | no CPE yet | The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49. | 18 Oct |
| CVE-2026-106370 | 4.7 medium | 0.00% | google, chrome | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 14 Oct |
| CVE-2026-106275 | 4.7 medium | 0.00% | google, chrome | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | 8 Oct |
| CVE-2026-106290 | 4.7 medium | 0.00% | google, chrome | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 8 Oct |
| CVE-2026-106395 | 4.7 medium | 0.00% | google, chrome | Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 8 Oct |
| CVE-2026-106223 | 4.7 medium | 0.00% | google, chrome | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | 8 Oct |
| CVE-2026-47362 | 4.6 medium | 0.00% | no CPE yet | In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history). Impact: Any actor able to bypass the app sandbox can read these databases in plaintext. | Fri 23 Oct |
| CVE-2026-92862 | 4.6 medium | 0.00% | no CPE yet | The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent. | 8 Oct |
| CVE-2025-21063 | 4.6 medium | 0.00% | samsung, voice_recorder | Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical attackers to access recording files on the lock screen. | 8 Oct |
| CVE-2026-0296 | 4.5 medium | 0.00% | paloaltonetworks, globalprotect | Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome OS is not affected. | Fri 23 Oct |
| CVE-2026-7941 | 4.4 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2025-21071 | 4.4 medium | 0.00% | samsung, android | Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. | 18 Oct |
| CVE-2025-20788 | 4.4 medium | 0.00% | google, android | In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117735; Issue ID: MSV-4539. | 18 Oct |
| CVE-2025-20789 | 4.4 medium | 0.00% | google, android | In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538. | 18 Oct |
| CVE-2026-106326 | 4.4 medium | 0.00% | google, chrome | Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium) | 8 Oct |
| CVE-2025-21044 | 4.4 medium | 0.00% | samsung, android | Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. | 8 Oct |
| CVE-2026-85330 | 4.3 medium | — | microsoft, microsoft edge (chromium-based) | Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. | 4 h ago |
| CVE-2026-23866 | 4.3 medium | 0.00% | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild. | Mon 26 Oct | |
| CVE-2026-7915 | 4.3 medium | 0.00% | google, chrome | Insufficient data validation in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-0245 | 4.3 medium | 0.00% | paloaltonetworks, prisma_access_agent | Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected. | Mon 26 Oct |
| CVE-2026-8552 | 4.3 medium | 0.00% | google, chrome | Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-12469 | 4.3 medium | 0.00% | google, chrome | Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | Mon 26 Oct |
| CVE-2026-8566 | 4.3 medium | 0.00% | google, chrome | Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium) | Mon 26 Oct |
| CVE-2026-0129 | 4.3 medium | 0.00% | google, android | In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | Sun 25 Oct |
| CVE-2026-0130 | 4.3 medium | 0.00% | google, android | In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | Sun 25 Oct |
| CVE-2026-0140 | 4.3 medium | 0.00% | google, android | In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. | Sun 25 Oct |
| CVE-2026-0157 | 4.3 medium | 0.00% | google, android | In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | Sun 25 Oct |
| CVE-2026-13941 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in SiteSettings in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13987 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13994 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Credential Management in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-13995 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | Sun 25 Oct |
| CVE-2026-14034 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14046 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14080 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14126 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14134 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14140 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-14141 | 4.3 medium | 0.00% | google, chrome | Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) | Sun 25 Oct |
| CVE-2026-59717 | 4.3 medium | 0.00% | no CPE yet | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1. | Sat 24 Oct |
| CVE-2026-17731 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sat 24 Oct |
| CVE-2026-17733 | 4.3 medium | 0.00% | google, chrome | Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Sat 24 Oct |
| CVE-2026-17767 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-17794 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-17802 | 4.3 medium | 0.00% | google, chrome | Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-17808 | 4.3 medium | 0.00% | google, chrome | Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | Fri 23 Oct |
| CVE-2026-17901 | 4.3 medium | 0.00% | google, chrome | Insufficient validation of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Low) | Fri 23 Oct |
| CVE-2026-17904 | 4.3 medium | 0.00% | google, chrome | Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | Fri 23 Oct |
Download these 567 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.