Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-21042KEVexploit | 9.8 critical | 36.0% | samsung, android | Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. | 8 Oct |
| CVE-2025-21043KEV | 9.8 critical | 2.0% | samsung, android | Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. | 8 Oct |
| CVE-2026-21010exploit | 7.8 high | 0.00% | samsung, android | Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions. | Mon 26 Oct |
| CVE-2026-21013exploit | 6.9 medium | 0.00% | samsung, galaxy_wearable | Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21012exploit | 6.8 medium | 0.00% | samsung, android | External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege. | Mon 26 Oct |
| CVE-2026-21015exploit | 6.8 medium | 0.00% | samsung, android | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier. | Mon 26 Oct |
| CVE-2026-21018exploit ×2 | 6.8 medium | 0.00% | samsung, android | Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code. | Mon 26 Oct |
| CVE-2026-21011exploit | 5.4 medium | 0.00% | samsung, android | Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend Unlock. | Mon 26 Oct |
| CVE-2026-21003exploit | 5.2 medium | 0.00% | samsung, android | Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions. | Mon 26 Oct |
| CVE-2026-21008exploit | 5.1 medium | 0.00% | samsung, android | Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information. | Mon 26 Oct |
| CVE-2026-21014exploit | 5.1 medium | 0.00% | samsung, camera | Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data. User interaction is required for triggering this vulnerability. | Mon 26 Oct |
| CVE-2026-21016exploit | 5.1 medium | 0.00% | samsung, android | Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information. | Mon 26 Oct |
| CVE-2026-21020exploit | 5.1 medium | 0.00% | samsung, android | Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions. | Mon 26 Oct |
| CVE-2026-21006exploit | 4.7 medium | 0.00% | samsung, android | Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents. | Mon 26 Oct |
| CVE-2026-21017exploit | 4.6 medium | 0.00% | samsung, android | Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files. | Mon 26 Oct |
| CVE-2026-21007exploit | 4.4 medium | 0.00% | samsung, android | Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard. | Mon 26 Oct |
| CVE-2026-21009exploit | 4.1 medium | 0.00% | samsung, android | Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning. | Mon 26 Oct |
| CVE-2020-26144 | 6.5 medium | 5.0% | samsung, arista, galaxy_i9305_firmware, c-250_firmware, c-260_firmware | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration. | 8 Oct |
| CVE-2026-110392 | 9.8 critical | 1.0% | no CPE yet | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection. | 16 Oct |
| CVE-2025-21079 | 8.1 high | 1.0% | samsung, members | Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability. | 18 Oct |
| CVE-2025-52910 | 9.8 critical | 0.00% | samsung, exynos_1280_firmware, exynos_1330_firmware, exynos_1380_firmware | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After-Free leads to privilege escalation. | Tue 27 Oct |
| CVE-2026-40446 | 9.8 critical | 0.00% | samsung, escargot | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335. | Mon 26 Oct |
| CVE-2025-62818 | 9.8 critical | 0.00% | samsung, exynos_990_firmware, exynos_980_firmware, exynos_850_firmware | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. An out-of-bounds write occurs due to a mismatch between the TP-UDHI and UDL values when processing an SMS TP-UD packet. | Mon 26 Oct |
| CVE-2026-25205 | 9.8 critical | 0.00% | samsung, escargot | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 . | Mon 26 Oct |
| CVE-2026-25207 | 9.8 critical | 0.00% | samsung, escargot | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335. | Mon 26 Oct |
| CVE-2026-25208 | 9.8 critical | 0.00% | samsung, escargot | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335. | Mon 26 Oct |
| CVE-2026-25206 | 9.1 critical | 0.00% | samsung, escargot | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335. | Mon 26 Oct |
| CVE-2026-25209 | 9.1 critical | 0.00% | samsung, escargot | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335. | Mon 26 Oct |
| CVE-2026-8915 | 8.8 high | 0.00% | samsung, escargot | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e31. | Mon 26 Oct |
| CVE-2026-21124 | 8.6 high | 0.00% | no CPE yet | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | 14 Oct |
| CVE-2026-21125 | 8.6 high | 0.00% | no CPE yet | Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code. | 14 Oct |
| CVE-2025-53966 | 8.4 high | 0.00% | samsung, exynos_1380_firmware, exynos_1480_firmware, exynos_1580_firmware | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow during handling of an IOCTL message. | Mon 26 Oct |
| CVE-2026-21068 | 8.4 high | 0.00% | samsung, android | Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code. | Fri 23 Oct |
| CVE-2026-25203 | 7.8 high | 0.00% | no CPE yet | Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: less than 21.1091.1. | Mon 26 Oct |
| CVE-2025-21048 | 7.8 high | 0.00% | samsung, android | Relative path traversal in Knox Enterprise prior to SMR Oct-2025 Release 1 allows local attackers to execute arbitrary code. | 8 Oct |
| CVE-2025-21051 | 7.8 high | 0.00% | samsung, android | Out-of-bounds write in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to write out-of-bounds memory. | 8 Oct |
| CVE-2025-21052 | 7.8 high | 0.00% | samsung, android | Out-of-bounds write under specific condition in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause memory corruption. | 8 Oct |
| CVE-2025-21053 | 7.8 high | 0.00% | samsung, android | Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause memory corruption. | 8 Oct |
| CVE-2025-21062 | 7.8 high | 0.00% | samsung, smart_switch | Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring application. User interaction is required for triggering this vulnerability. | 8 Oct |
| CVE-2026-40447 | 7.5 high | 0.00% | samsung, escargot | Integer overflow or wraparound vulnerability in Samsung Open Source Escargot allows undefined behavior.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335. | Mon 26 Oct |
| CVE-2026-25204 | 7.5 high | 0.00% | samsung, escargot | Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 | Mon 26 Oct |
| CVE-2025-59440 | 7.5 high | 0.00% | samsung, exynos_990_firmware, exynos_980_firmware, exynos_850_firmware | An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Improper handling of SIM card proactive commands leads to a Denial of Service. | Sat 24 Oct |
| CVE-2025-57835 | 7.5 high | 0.00% | samsung, exynos_990_firmware, exynos_980_firmware, exynos_850_firmware | An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Improper memory initialization results in an illegal memory access, causing a system crash via a malformed RRCReconfiguration message. | Fri 23 Oct |
| CVE-2025-21074 | 7.5 high | 0.00% | samsung, android | Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. | 18 Oct |
| CVE-2025-21075 | 7.5 high | 0.00% | samsung, android | Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. | 18 Oct |
| CVE-2025-21055 | 7.5 high | 0.00% | samsung, android | Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory. | 8 Oct |
| CVE-2026-21139 | 7.3 high | 0.00% | no CPE yet | Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device. | 15 Oct |
| CVE-2025-21066 | 7.1 high | 0.00% | samsung, notes | Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | 8 Oct |
| CVE-2025-21067 | 7.1 high | 0.00% | samsung, notes | Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | 8 Oct |
| CVE-2025-21068 | 7.1 high | 0.00% | samsung, notes | Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. | 8 Oct |
50 of 162 · Next
Download these 162 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 23:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.