AN
Product
Android
On CISA KEVExploited in the wild
502
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 181Medium 243Low 65
Watch
Add Android to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-20974 | 4.6 | Jan 9 | Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-58476 | 4.6 | Dec 2 | Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20884 | 4.6 | Feb 4 | Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2025-20883 | 4.6 | Feb 4 | Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-49411 | 4.6 | Dec 3 | Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-49402 | 4.6 | Nov 6 | Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +31 more |
| CVE-2024-34675 | 4.6 | Nov 6 | Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +31 more |
| CVE-2024-34674 | 4.6 | Nov 6 | Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34653 | 4.6 | Sep 4 | Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34645 | 4.6 | Sep 4 | Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privileged applications Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34642 | 4.6 | Sep 4 | Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34639 | 4.6 | Sep 4 | Improper handling of exceptional conditions in Setupwizard prior to SMR Aug-2024 Release 1 allows physical attackers to bypass proper validation Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20882 | 4.6 | Jun 4 | Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-30731 | 4.6 | Oct 4 | Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application that has different build type Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +31 more |
| CVE-2023-30714 | 4.6 | Sep 6 | Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers to change some settings of the folder… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21486 | 4.6 | May 4 | Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21485 | 4.6 | May 4 | Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2026-20991 | 4.4 | Mar 16 | Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2025-58475 | 4.4 | Dec 2 | Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21072 | 4.4 | Dec 2 | Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21071 | 4.4 | Nov 5 | Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21044 | 4.4 | Oct 10 | Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21027 | 4.4 | Sep 3 | Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21025 | 4.4 | Sep 3 | Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20958 | 4.4 | May 7 | Improper verification of intent by broadcast receiver in UnifiedWFC prior to SMR May-2025 Release 1 allows local attackers to manipulate VoWiFi related behaviors Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20953 | 4.4 | May 7 | Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch activities within SmartManagerCN Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20943 | 4.4 | Apr 8 | Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20942 | 4.4 | Apr 8 | Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20907 | 4.4 | Feb 4 | Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2025-20886 | 4.4 | Feb 4 | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-42568 | 4.4 | Dec 5 | Improper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files with system privilege Affected: 12.0 before 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +10 more |
| CVE-2023-30721 | 4.4 | Sep 6 | Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker to get lock screen match information… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30665 | 4.4 | Jul 6 | Improper input validation vulnerability in OnOemServiceMode in libsec-ril prior to SMR Jul-2023 Release 1 allows local attackers to cause an Out-Of-Bounds read Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21460 | 4.4 | Mar 16 | Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2024-34592 | 4.3 | Jul 2 | Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34591 | 4.3 | Jul 2 | Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34590 | 4.3 | Jul 2 | Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20894 | 4.3 | Jul 2 | Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authentication under certain condition Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20889 | 4.3 | Jul 2 | Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20856 | 4.3 | May 7 | Improper Authentication vulnerability in Secure Folder prior to SMR May-2024 Release 1 allows physical attackers to access Secure Folder without proper authentication in a… Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +25 more |
| CVE-2023-30641 | 4.3 | Jul 6 | Improper access control vulnerability in Settings prior to SMR Jul-2023 Release 1 allows physical attacker to use restricted user profile to access device owner's google… Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +3 more |
| CVE-2025-21073 | 4.1 | Nov 5 | Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20962 | 4.0 | May 7 | Improper handling of insufficient permission in SpenGesture service prior to SMR May-2025 Release 1 allows local attackers to track the S Pen position Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)