Vulnerabilities
Tracked app vulnerabilities
27,728 CVEs affect a tracked app or OS (all severities, all platforms). 377 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 27,728
- Actively exploited
- 377
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-48614
MEDIUM 4.6
In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This cou… |
|
CVE-2025-48612
HIGH 7.8
In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper … |
|
CVE-2025-48610
MEDIUM 5.5
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local inf… |
|
CVE-2025-48607
MEDIUM 5.5
In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service… |
|
CVE-2025-48604
MEDIUM 5.5
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
|
CVE-2025-48603
MEDIUM 5.5
In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of serv… |
|
CVE-2025-48601
MEDIUM 5.5
In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with … |
|
CVE-2025-48600
MEDIUM 5.5
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosur… |
|
CVE-2025-48599
HIGH 7.8
In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could… |
|
CVE-2025-48598
MEDIUM 6.6
In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalatio… |
|
CVE-2025-48597
HIGH 7.8
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalat… |
|
CVE-2025-48596
HIGH 7.8
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no add… |
|
CVE-2025-48594
HIGH 7.3
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper inp… |
|
CVE-2025-48592
HIGH 7.5
In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure wi… |
|
CVE-2025-48591
MEDIUM 5.5
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
|
CVE-2025-48590
MEDIUM 5.5
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances d… |
|
CVE-2025-48589
HIGH 7.8
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. This coul… |
|
CVE-2025-48588
HIGH 7.8
In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of priv… |
|
CVE-2025-48586
HIGH 7.8
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to l… |
|
CVE-2025-48584
MEDIUM 5.5
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This co… |
|
CVE-2025-48583
HIGH 7.8
In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalati… |
|
CVE-2025-48580
HIGH 7.8
In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the c… |
|
CVE-2025-48576
MEDIUM 5.5
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exh… |
|
CVE-2025-48575
HIGH 7.8
In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation o… |
|
CVE-2025-48573
HIGH 7.8
In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use … |
|
CVE-2025-48572
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of pri… |
|
CVE-2025-48566
HIGH 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
|
CVE-2025-48565
HIGH 7.8
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation … |
|
CVE-2025-48564
HIGH 7.0
In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional ex… |
|
CVE-2025-48555
HIGH 7.8
In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local … |
|
CVE-2025-48536
HIGH 7.8
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused … |
|
CVE-2025-48525
HIGH 7.8
In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device… |
|
CVE-2025-32329
HIGH 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Thi… |
|
CVE-2025-32328
HIGH 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Thi… |
|
CVE-2025-32319
MEDIUM 6.7
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could … |
|
CVE-2025-22432
MEDIUM 6.7
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalat… |
|
CVE-2025-22420
HIGH 7.8
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privil… |
|
CVE-2025-58098
HIGH 8.3
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd… |
|
CVE-2025-66200
MEDIUM 5.4
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can … |
|
CVE-2025-65082
MEDIUM 6.5
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuratio… |
|
CVE-2025-59775
HIGH 7.5
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially … |
|
CVE-2025-55753
HIGH 7.5
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer… |
|
CVE-2025-40266
HIGH 8.2
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent … |
|
CVE-2025-40214
HIGH 7.8
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC c… |
|
CVE-2025-13992
MEDIUM 4.7
Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a cra… |
|
CVE-2025-12084
MEDIUM · vendor
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Avail… |
|
CVE-2025-13721
HIGH 7.5
Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
|
CVE-2025-13720
HIGH 8.8
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corru… |
|
CVE-2025-13640
LOW 3.5
Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the … |
|
CVE-2025-13639
HIGH 8.1
Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.