AN
Product
Android
On CISA KEVExploited in the wild
502
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 181Medium 243Low 65
Watch
Add Android to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-58480 | 7.5 | Dec 2 | Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-58479 | 7.5 | Dec 2 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-58478 | 7.5 | Dec 2 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21075 | 7.5 | Nov 5 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21074 | 7.5 | Nov 5 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21055 | 7.5 | Oct 10 | Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2023-42532 | 7.5 | Nov 7 | Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic including Firmware information Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-42530 | 7.5 | Nov 7 | Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi and Wi-Fi Direct without User Interaction Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30727 | 7.5 | Oct 4 | Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi and connect arbitrary Wi-Fi without User Interaction Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30708 | 7.5 | Sep 6 | Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock status Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2025-20903 | 7.3 | Mar 6 | Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34676 | 7.3 | Nov 6 | Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2026-21100 | 7.1 | Sep 9 | Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21059 | 7.1 | Aug 10 | Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege Affected: 16.0; 16.0; 16.0; 16.0; 16.0; 16.0; +7 more |
| CVE-2026-21058 | 7.1 | Aug 10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2025-21080 | 7.1 | Dec 2 | Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege Affected: 15.0; 15.0; 15.0; 15.0; 15.0; 15.0; +9 more |
| CVE-2023-21474 | 7.1 | Sep 3 | Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2025-21015 | 7.1 | Aug 6 | Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege Affected: 15.0; 15.0; 15.0; 15.0; 15.0; 15.0 |
| CVE-2025-20988 | 7.1 | Jun 4 | Out-of-bounds read in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to read out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20948 | 7.1 | Apr 8 | Out-of-bounds read in enrollment with cdsp frame secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to read out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20944 | 7.1 | Apr 8 | Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2024-49401 | 7.1 | Nov 6 | Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2024-34679 | 7.1 | Nov 6 | Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +31 more |
| CVE-2024-34638 | 7.1 | Sep 4 | Improper handling of exceptional conditions in ThemeCenter prior to SMR Sep-2024 Release 1 allows local attackers to delete non-preloaded applications Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20879 | 7.1 | Jun 4 | Improper input validation vulnerability in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to write out-of-bounds memory Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-52432 | 7.1 | Mar 5 | Improper input validation in IpcTxSndSetLoopbackCtrl in libsec-ril prior to SMR Sep-2023 Release 1 allows local attackers to write out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2024-20820 | 7.1 | Feb 6 | Improper input validation in bootloader prior to SMR Feb-2024 Release 1 allows local privileged attackers to cause an Out-Of-Bounds read Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-42531 | 7.1 | Nov 7 | Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from the background Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30707 | 7.1 | Sep 6 | Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30643 | 7.1 | Jul 6 | Missing authentication vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to delete arbitrary non-preloaded applications Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21490 | 7.1 | May 4 | Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)