AN
Product
Android
On CISA KEVExploited in the wild
502
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 181Medium 243Low 65
Watch
Add Android to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-49422 | 3.9 | Dec 31 | Protection Mechanism Failure in bootloader prior to SMR Oct-2024 Release 1 allows physical attackers to reset lockscreen failure count by hardware fault injection Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +28 more |
| CVE-2026-21062 | 3.3 | Aug 10 | Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21027 | 3.3 | Jun 5 | Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-21012 | 3.3 | Apr 13 | External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system privilege Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +34 more |
| CVE-2026-20992 | 3.3 | Mar 16 | Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2026-20972 | 3.3 | Jan 9 | Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21029 | 3.3 | Sep 3 | Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21026 | 3.3 | Sep 3 | Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2023-21471 | 3.3 | Sep 3 | Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +25 more |
| CVE-2023-21470 | 3.3 | Sep 3 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21469 | 3.3 | Sep 3 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21466 | 3.3 | Sep 3 | PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider without proper permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2025-20990 | 3.3 | Aug 6 | Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-21000 | 3.3 | Jul 8 | Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20985 | 3.3 | Jun 4 | Improper privilege management in ThemeManager prior to SMR Jun-2025 Release 1 allows local privileged attackers to reuse trial items Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20960 | 3.3 | May 7 | Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privileged api Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2025-20941 | 3.3 | Apr 8 | Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +34 more |
| CVE-2024-34677 | 3.3 | Nov 6 | Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34652 | 3.3 | Sep 4 | Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance including app usage Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34650 | 3.3 | Sep 4 | Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Edge panel Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +29 more |
| CVE-2024-34641 | 3.3 | Sep 4 | Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34640 | 3.3 | Sep 4 | Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of process expiration Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34618 | 3.3 | Aug 7 | Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34617 | 3.3 | Aug 7 | Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Message application Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +28 more |
| CVE-2024-34586 | 3.3 | Jul 2 | Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-34583 | 3.3 | Jul 2 | Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20900 | 3.3 | Jul 2 | Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20885 | 3.3 | Jun 4 | Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without proper permission Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +26 more |
| CVE-2024-20872 | 3.3 | May 7 | Improper handling of insufficient privileges vulnerability in TalkbackSE prior to version Android 14 allows local attackers to modify setting value of TalkbackSE Affected: 14.0 |
| CVE-2024-20860 | 3.3 | May 7 | Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device without proper… Affected: 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +25 more |
| CVE-2024-20847 | 3.3 | Apr 2 | Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2024-20834 | 3.3 | Mar 5 | The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address without proper permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2024-20811 | 3.3 | Feb 6 | Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2024-20810 | 3.3 | Feb 6 | Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information Affected: 12.0; 12.0; 12.0; 12.0; 12.0; 12.0; +34 more |
| CVE-2023-42570 | 3.3 | Dec 5 | Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN Affected: 11.0 before 14.0; 14.0; 14.0; 14.0; 14.0; 14.0; +10 more |
| CVE-2023-42569 | 3.3 | Dec 5 | Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Emoji Affected: 11.0 before 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +10 more |
| CVE-2023-30732 | 3.3 | Oct 4 | Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +7 more |
| CVE-2023-30719 | 3.3 | Sep 6 | Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30718 | 3.3 | Sep 6 | Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30717 | 3.3 | Sep 6 | Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30715 | 3.3 | Sep 6 | Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weather without permission Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30711 | 3.3 | Sep 6 | Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30700 | 3.3 | Aug 10 | PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access ContentProvider without proper… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30685 | 3.3 | Aug 10 | Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-30684 | 3.3 | Aug 10 | Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permission Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30683 | 3.3 | Aug 10 | Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30682 | 3.3 | Aug 10 | Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +5 more |
| CVE-2023-30667 | 3.3 | Jul 6 | Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege Affected: 13.0; 13.0; 13.0; 13.0; 13.0; 13.0; +3 more |
| CVE-2023-30640 | 3.3 | Jul 6 | Improper access control vulnerability in PersonaManagerService prior to SMR Jul-2023 Release 1 allows local attackers to change confiugration Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
| CVE-2023-21512 | 3.3 | Jun 28 | Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access… Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)