Vulnerabilities
Tracked app vulnerabilities
6,476 CVEs affect a tracked app or OS (all severities, Android). 48 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,476
- Actively exploited
- 48
- Publication window
- 2015-07-23 → 2026-11-04
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-26110
CRITICAL · vendor
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2026-25180
HIGH · vendor
Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally. |
|
CVE-2026-24285
HIGH · vendor
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-23240
CRITICAL 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a cod… |
|
CVE-2026-33636
HIGH · vendor
LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 |
|
CVE-2026-3537
HIGH 8.8
Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a cr… |
|
CVE-2026-0047
HIGH 8.4
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This co… |
|
CVE-2026-0035
HIGH 8.4
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. Th… |
|
CVE-2026-0034
HIGH 8.4
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to lo… |
|
CVE-2026-0025
HIGH 8.4
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation o… |
|
CVE-2026-0024
MEDIUM 4.0
In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check.… |
|
CVE-2026-0023
HIGH 7.8
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This co… |
|
CVE-2026-0021
HIGH 8.4
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to loca… |
|
CVE-2026-0020
HIGH 8.4
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. Th… |
|
CVE-2026-0017
HIGH 7.7
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalatio… |
|
CVE-2026-0015
MEDIUM 6.2
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial… |
|
CVE-2026-0014
MEDIUM 6.2
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
|
CVE-2026-0013
HIGH 8.4
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local esca… |
|
CVE-2026-0012
MEDIUM 6.2
In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local inf… |
|
CVE-2026-0011
HIGH 8.4
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead t… |
|
CVE-2026-0010
HIGH 8.4
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privileg… |
|
CVE-2025-48654
HIGH 7.8
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of … |
|
CVE-2025-48646
HIGH 7.8
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with … |
|
CVE-2025-48645
CRITICAL 9.8
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of pri… |
|
CVE-2025-48644
MEDIUM 5.5
In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no ad… |
|
CVE-2025-48642
MEDIUM 5.5
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure … |
|
CVE-2025-48641
HIGH 7.0
In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional… |
|
CVE-2025-48630
HIGH 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to l… |
|
CVE-2025-48602
HIGH 8.4
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This… |
|
CVE-2025-48585
MEDIUM 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
|
CVE-2025-48582
HIGH 8.4
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to loc… |
|
CVE-2026-21385
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20434
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20428
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20427
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20426
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20425
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20422
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20421
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20420
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20406
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20405
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20404
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20403
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20402
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20401
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-0038
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-0037
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-0032
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-0031
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.