AN
Product
Android
On CISA KEVExploited in the wild
502
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 181Medium 243Low 65
Watch
Add Android to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-21043 In wildKEV | 9.8 | Sep 12 | Samsung Mobile Devices Out-of-Bounds Write Vulnerability Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21042 In wildKEV | 9.8 | Sep 12 | Samsung Mobile Devices Out-of-Bounds Write Vulnerability Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2021-25487 In wildKEV | 7.8 | Oct 6 | Samsung Mobile Devices Out-of-Bounds Read Vulnerability Affected: 8.1; 9.0; 9.0; 9.0; 9.0; 9.0; +22 more |
| CVE-2021-25337 In wildKEV | 7.1 | Mar 4 | Samsung Mobile Devices Improper Access Control Vulnerability Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2021-25372 In wildKEV | 6.7 | Mar 26 | Samsung Mobile Devices Improper Boundary Check Vulnerability Affected: 10.0; 10.0; 11.0; 11.0 |
| CVE-2021-25371 In wildKEV | 6.7 | Mar 26 | Samsung Mobile Devices Unspecified Vulnerability Affected: 10.0; 10.0; 11.0; 11.0 |
| CVE-2021-25395 In wildKEV | 6.4 | Jun 11 | Samsung Mobile Devices Race Condition Vulnerability Affected: 8.1; 9.0; 9.0; 9.0; 9.0; 10.0; +6 more |
| CVE-2021-25394 In wildKEV | 6.4 | Jun 11 | Samsung Mobile Devices Race Condition Vulnerability Affected: 8.1; 9.0; 9.0; 9.0; 9.0; 10.0; +6 more |
| CVE-2021-25489 In wildKEV | 5.5 | Oct 6 | Samsung Mobile Devices Improper Input Validation Vulnerability Affected: 8.1; 9.0; 9.0; 9.0; 9.0; 9.0; +22 more |
| CVE-2021-25369 In wildKEV | 5.5 | Mar 26 | Samsung Mobile Devices Improper Access Control Vulnerability Affected: 8.0; 8.1; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2023-21492 In wildKEV | 4.4 | May 4 | Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2021-25370 In wildKEV | 4.4 | Mar 26 | Samsung Mobile Devices Memory Corruption Vulnerability Affected: 8.0; 8.1; 9.0; 9.0; 9.0; 9.0; +34 more |
| CVE-2026-21096 | 9.8 | Sep 9 | Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21095 | 9.8 | Sep 9 | Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2024-49415 | 9.8 | Dec 3 | Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-30699 | 9.8 | Aug 10 | Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remote attackers Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21504 | 9.8 | May 4 | Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21503 | 9.8 | May 4 | Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +2 more |
| CVE-2023-21494 | 9.8 | May 4 | Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory… Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +2 more |
| CVE-2023-21459 | 9.8 | Mar 16 | Use after free vulnerability in decon driver prior to SMR Mar-2023 Release 1 allows attackers to cause memory access fault Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2026-20973 | 9.1 | Jan 9 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Jan-2026 Release 1 allows remote attacker to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2026-21094 | 8.8 | Sep 9 | Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2024-34669 | 8.8 | Oct 8 | Out-of-bounds write in parsing h.263+ format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34668 | 8.8 | Oct 8 | Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34667 | 8.8 | Oct 8 | Out-of-bounds write in parsing h.265 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34666 | 8.8 | Oct 8 | Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system… Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34665 | 8.8 | Oct 8 | Out-of-bounds write in parsing h.264 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34619 | 8.8 | Aug 7 | Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34593 | 8.8 | Jul 2 | Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system… Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20890 | 8.8 | Jul 2 | Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2026-20990 | 8.1 | Mar 16 | Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2023-21457 | 8.1 | Mar 16 | Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without related permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2026-21091 | 7.8 | Sep 9 | Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21090 | 7.8 | Sep 9 | Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21089 | 7.8 | Sep 9 | Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21088 | 7.8 | Sep 9 | Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21087 | 7.8 | Sep 9 | Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege Affected: 15.0; 15.0; 15.0; 15.0; 15.0; 15.0; +30 more |
| CVE-2026-21086 | 7.8 | Sep 9 | Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21072 | 7.8 | Aug 10 | Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21071 | 7.8 | Aug 10 | Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21069 | 7.8 | Aug 10 | Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21068 | 7.8 | Aug 10 | Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21067 | 7.8 | Aug 10 | Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21066 | 7.8 | Aug 10 | Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21065 | 7.8 | Aug 10 | Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21031 | 7.8 | Jun 5 | Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity Affected: 15.0; 15.0; 15.0; 15.0; 15.0; 15.0; +23 more |
| CVE-2026-21030 | 7.8 | Jun 5 | Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21029 | 7.8 | Jun 5 | Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21020 | 7.8 | May 13 | Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21010 | 7.8 | Apr 13 | Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)
