AN
Product
Android
On CISA KEVExploited in the wild
502
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 181Medium 243Low 65
Watch
Add Android to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-20960 | 3.3 | May 7 | Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privileged api Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20941 | 3.3 | Apr 8 | Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2024-34677 | 3.3 | Nov 6 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34652 | 3.3 | Sep 4 | Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34650 | 3.3 | Sep 4 | Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +29 more |
| CVE-2024-34641 | 3.3 | Sep 4 | Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34640 | 3.3 | Sep 4 | Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of process expiration Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34618 | 3.3 | Aug 7 | Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34617 | 3.3 | Aug 7 | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +28 more |
| CVE-2024-34586 | 3.3 | Jul 2 | Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34583 | 3.3 | Jul 2 | Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20900 | 3.3 | Jul 2 | Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20885 | 3.3 | Jun 4 | Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without proper permission Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +26 more |
| CVE-2024-20872 | 3.3 | May 7 | Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify setting value of TalkbackSE Affected: 14.0 |
| CVE-2024-20860 | 3.3 | May 7 | Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device without proper… Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +25 more |
| CVE-2024-20847 | 3.3 | Apr 2 | Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20834 | 3.3 | Mar 5 | The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address without proper permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2024-20811 | 3.3 | Feb 6 | Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2024-20810 | 3.3 | Feb 6 | Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-42570 | 3.3 | Dec 5 | Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN Affected: 11.0 before 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +10 more |
| CVE-2023-42569 | 3.3 | Dec 5 | Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji Affected: 11.0 before 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +10 more |
| CVE-2023-30732 | 3.3 | Oct 4 | Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +7 more |
| CVE-2023-30719 | 3.3 | Sep 6 | Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30718 | 3.3 | Sep 6 | Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30717 | 3.3 | Sep 6 | Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30715 | 3.3 | Sep 6 | Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30711 | 3.3 | Sep 6 | Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30700 | 3.3 | Aug 10 | PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider without proper… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30685 | 3.3 | Aug 10 | Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30684 | 3.3 | Aug 10 | Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30683 | 3.3 | Aug 10 | Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30682 | 3.3 | Aug 10 | Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30667 | 3.3 | Jul 6 | Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +3 more |
| CVE-2023-30640 | 3.3 | Jul 6 | Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allows local attackers to change confiugration Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21512 | 3.3 | Jun 28 | Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21487 | 3.3 | May 4 | Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21458 | 3.3 | Mar 16 | Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn off Do not disturb via unprotected intent Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21452 | 3.3 | Mar 16 | Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21436 | 3.3 | Feb 9 | Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +34 more |
| CVE-2023-21429 | 3.3 | Feb 9 | Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +34 more |
| CVE-2023-21428 | 3.3 | Feb 9 | Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21424 | 3.3 | Feb 9 | Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacker to modify network related values,… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2026-21006 | 2.4 | Apr 13 | Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents Affected: 15.0; 15.0; 15.0; 15.0; 15.0; 15.0; +10 more |
| CVE-2026-20989 | 2.4 | Mar 16 | Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font Affected: 16.0; 16.0; 16.0; 16.0; 16.0; 16.0; +2 more |
| CVE-2025-21046 | 2.4 | Oct 10 | Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to recent app list Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2024-49414 | 2.4 | Dec 3 | Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34682 | 2.4 | Nov 6 | Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance Mode Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +31 more |
| CVE-2024-34649 | 2.4 | Sep 4 | Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access an unlocked screen Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +29 more |
| CVE-2024-20855 | 2.4 | May 7 | Improper access control vulnerability in multitasking framework prior to SMR May-2024 Release 1 allows physical attackers to access unlocked screen for a while Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +25 more |
| CVE-2023-21454 | 2.4 | Mar 16 | Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockscreen Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)