Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-21068 | 7.1 high | 0.00% | samsung, notes | Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | 8 Oct |
| CVE-2025-21069 | 7.1 high | 0.00% | samsung, notes | Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | 8 Oct |
| CVE-2026-21064 | 7.0 high | 0.00% | samsung, android | Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. | Fri 23 Oct |
| CVE-2026-21079 | 7.0 high | 0.00% | samsung, smart_switch | Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. | Fri 23 Oct |
| CVE-2026-3291 | 6.9 medium | 0.00% | hp, samsung_print_service_plugin | Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities. | Mon 26 Oct |
| CVE-2026-21022 | 6.9 medium | 0.00% | samsung, android | Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21025 | 6.9 medium | 0.00% | samsung, android | Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21032 | 6.9 medium | 0.00% | samsung, assistant | Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script. | Mon 26 Oct |
| CVE-2026-21033 | 6.9 medium | 0.00% | samsung, assistant | Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script. | Mon 26 Oct |
| CVE-2026-21023 | 6.9 medium | 0.00% | samsung, android | Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific application. | Mon 26 Oct |
| CVE-2026-21037 | 6.9 medium | 0.00% | samsung, members | Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsung Members privilege. | Sun 25 Oct |
| CVE-2026-21058 | 6.9 medium | 0.00% | samsung, android | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Fri 23 Oct |
| CVE-2026-21059 | 6.9 medium | 0.00% | samsung, android | Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | Fri 23 Oct |
| CVE-2026-21076 | 6.9 medium | 0.00% | samsung, health | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | Fri 23 Oct |
| CVE-2026-21077 | 6.9 medium | 0.00% | samsung, health | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | Fri 23 Oct |
| CVE-2026-21080 | 6.9 medium | 0.00% | samsung, smart_switch | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | Fri 23 Oct |
| CVE-2026-21082 | 6.9 medium | 0.00% | samsung, health | Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | Fri 23 Oct |
| CVE-2026-21127 | 6.9 medium | 0.00% | no CPE yet | Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data. | 16 Oct |
| CVE-2026-21126 | 6.9 medium | 0.00% | no CPE yet | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | 16 Oct |
| CVE-2026-21029 | 6.8 medium | 0.00% | samsung, android | Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations. | Mon 26 Oct |
| CVE-2026-21057 | 6.8 medium | 0.00% | no CPE yet | Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory. | Sun 25 Oct |
| CVE-2026-21063 | 6.8 medium | 0.00% | samsung, android | Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock function. | Fri 23 Oct |
| CVE-2026-21083 | 6.8 medium | 0.00% | samsung, smart_switch | Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | Fri 23 Oct |
| CVE-2025-21047 | 6.8 medium | 0.00% | samsung, android | Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs. | 8 Oct |
| CVE-2026-21060 | 6.7 medium | 0.00% | samsung, android | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles. | Fri 23 Oct |
| CVE-2026-41666 | 6.6 medium | 0.00% | samsung, one | Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation. Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2026-40449 | 6.6 medium | 0.00% | samsung, one | Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE. Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2026-40450 | 6.6 medium | 0.00% | samsung, one | Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors. Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2026-41664 | 6.6 medium | 0.00% | samsung, one | Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes. Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2026-41667 | 6.6 medium | 0.00% | samsung, one | Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2026-6839 | 6.6 medium | 0.00% | samsung, one | Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Open Source ONE Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2025-54335 | 6.5 medium | 0.00% | samsung, exynos_1480_firmware, exynos_1580_firmware, exynos_2400_firmware | An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclipse GPU Driver. | Tue 27 Oct |
| CVE-2026-21035 | 6.5 medium | 0.00% | samsung, plus_tv | Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-18772 | 6.5 medium | 0.00% | samsung, rlottie | Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. | Fri 23 Oct |
| CVE-2026-19587 | 6.5 medium | 0.00% | samsung, rlottie | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation. | Fri 23 Oct |
| CVE-2026-19588 | 6.5 medium | 0.00% | samsung, rlottie | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. | Fri 23 Oct |
| CVE-2026-19517 | 6.5 medium | 0.00% | samsung, rlottie | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows Excessive Allocation. | Fri 23 Oct |
| CVE-2026-19518 | 6.5 medium | 0.00% | samsung, rlottie | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. | Fri 23 Oct |
| CVE-2025-21078 | 6.5 medium | 0.00% | samsung, smart_switch | Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications. | 18 Oct |
| CVE-2025-21064 | 6.5 medium | 0.00% | samsung, smart_switch | Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data. | 8 Oct |
| CVE-2026-21026 | 6.4 medium | 0.00% | samsung, android | Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information. | Mon 26 Oct |
| CVE-2026-21030 | 6.4 medium | 0.00% | samsung, android | Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions. | Mon 26 Oct |
| CVE-2026-21036 | 6.3 medium | 0.00% | samsung, internet | Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21024 | 6.3 medium | 0.00% | no CPE yet | Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions. | Mon 26 Oct |
| CVE-2025-52516 | 6.2 medium | 0.00% | samsung, exynos_1330_firmware, exynos_1380_firmware, exynos_1480_firmware | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the issimian device driver leads to a denial of service. | 19 Oct |
| CVE-2026-40340 | 6.1 medium | 0.00% | no CPE yet | libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlibs/ptp2/ptp-pack.c` (lines 530–563). The function validates `len < PTP_oi_SequenceNumber` (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue. | Mon 26 Oct |
| CVE-2026-41665 | 6.1 medium | 0.00% | samsung, one | Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors. Affected version is prior to commit 1.30.0. | Mon 26 Oct |
| CVE-2026-58303 | 6.1 medium | 0.00% | no CPE yet | Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before b30b63fc63b403907d8137da1c65aaa4521fe74e. | Sun 25 Oct |
| CVE-2026-58304 | 6.1 medium | 0.00% | no CPE yet | Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a. | Sun 25 Oct |
| CVE-2026-58305 | 6.1 medium | 0.00% | no CPE yet | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a. | Sun 25 Oct |
Download these 163 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.