AN
Product
Android
On CISA KEVExploited in the wild
502
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 181Medium 243Low 65
Watch
Add Android to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-42527 | 5.5 | Nov 7 | Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive information Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30720 | 5.5 | Sep 6 | PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30716 | 5.5 | Sep 6 | Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30713 | 5.5 | Sep 6 | Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to change some settings of the folder lock Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30701 | 5.5 | Aug 10 | PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30698 | 5.5 | Aug 10 | Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30654 | 5.5 | Aug 10 | Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30671 | 5.5 | Jul 6 | Logic error in package installation via adb command prior to SMR Jul-2023 Release 1 allows local attackers to downgrade installed application Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +23 more |
| CVE-2023-30662 | 5.5 | Jul 6 | Exposure of Sensitive Information vulnerability in getChipIds in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset Identifier Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +23 more |
| CVE-2023-30661 | 5.5 | Jul 6 | Exposure of Sensitive Information vulnerability in getChipInfos in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset… Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +23 more |
| CVE-2023-30660 | 5.5 | Jul 6 | Exposure of Sensitive Information vulnerability in getDefaultChipId in UwbAospAdapterService prior to SMR Jul-2023 Release 1 allows local attackers to access the UWB chipset… Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +23 more |
| CVE-2023-30648 | 5.5 | Jul 6 | Stack out-of-bounds write vulnerability in IpcRxImeiUpdateImeiNoti of RILD priro to SMR Jul-2023 Release 1 cause a denial of service on the system Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30642 | 5.5 | Jul 6 | Improper privilege management vulnerability in Galaxy Themes Service prior to SMR Jul-2023 Release 1 allows local attackers to call privilege function Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +23 more |
| CVE-2023-21500 | 5.5 | May 4 | Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +2 more |
| CVE-2023-21496 | 5.5 | May 4 | Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21495 | 5.5 | May 4 | Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21493 | 5.5 | May 4 | Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21461 | 5.5 | Mar 16 | Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via unprotected activity Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21456 | 5.5 | Mar 16 | Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uid Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21453 | 5.5 | Mar 16 | Improper input validation vulnerability in SoftSim TA prior to SMR Mar-2023 Release 1 allows local attackers access to protected data Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0 |
| CVE-2023-21449 | 5.5 | Mar 16 | Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive information without proper permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21446 | 5.5 | Feb 9 | Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(13) allows local attacker to access data… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21442 | 5.5 | Feb 9 | Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) allows local attackers to get device… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21441 | 5.5 | Feb 9 | Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(11) and 3.5.2.23 in Android S(12)… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +34 more |
| CVE-2023-21440 | 5.5 | Feb 9 | Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +9 more |
| CVE-2023-21437 | 5.5 | Feb 9 | Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive information via implicit broadcast Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +34 more |
| CVE-2023-21435 | 5.5 | Feb 9 | Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21426 | 5.5 | Feb 9 | Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +34 more |
| CVE-2023-21425 | 5.5 | Feb 9 | Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive information Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +34 more |
| CVE-2023-21423 | 5.5 | Feb 9 | Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without permission using unprotected action Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-21422 | 5.5 | Feb 9 | Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS server without permission via binding… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2026-21092 | 5.3 | Sep 9 | Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2023-21479 | 5.3 | Sep 3 | Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +11 more |
| CVE-2024-20830 | 5.3 | Mar 5 | Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2025-20989 | 5.2 | Jun 4 | Improper logging in fingerprint trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to get a hmac_key Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2023-42559 | 5.2 | Dec 5 | Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Knox Guard lock bypass via changing system time Affected: 11.0 before 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +10 more |
| CVE-2025-20991 | 5.1 | Jun 4 | Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20893 | 5.1 | Feb 4 | Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +33 more |
| CVE-2026-20988 | 5.0 | Mar 16 | Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege Affected: 16.0; 16.0; 16.0; 16.0; 16.0; 16.0; +2 more |
| CVE-2023-30706 | 4.9 | Sep 6 | Improper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to read arbitrary file with system privilege Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2026-21070 | 4.6 | Aug 10 | Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21060 | 4.6 | Aug 10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-20974 | 4.6 | Jan 9 | Improper input validation in data related to network restrictions prior to SMR Jan-2026 Release 1 allows physical attackers to bypass Carrier Relock Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-58476 | 4.6 | Dec 2 | Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20884 | 4.6 | Feb 4 | Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2025-20883 | 4.6 | Feb 4 | Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-49411 | 4.6 | Dec 3 | Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-49402 | 4.6 | Nov 6 | Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +31 more |
| CVE-2024-34675 | 4.6 | Nov 6 | Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +31 more |
| CVE-2024-34674 | 4.6 | Nov 6 | Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)