Vulnerabilities
Tracked app vulnerabilities
670 CVEs affect a tracked app or OS (Medium, Android). 5 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 670
- Actively exploited
- 5
- Publication window
- 2016-05-09 → 2026-11-02
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-48598
MEDIUM 6.6
In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalatio… |
|
CVE-2025-48591
MEDIUM 5.5
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
|
CVE-2025-48590
MEDIUM 5.5
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances d… |
|
CVE-2025-48584
MEDIUM 5.5
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This co… |
|
CVE-2025-48576
MEDIUM 5.5
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exh… |
|
CVE-2025-32319
MEDIUM 6.7
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could … |
|
CVE-2025-22432
MEDIUM 6.7
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalat… |
|
CVE-2025-20792
MEDIUM 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
|
CVE-2025-20755
MEDIUM 5.3
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue… |
|
CVE-2025-58408
MEDIUM 5.9
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and… |
|
CVE-2025-8045
MEDIUM 4.0
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
|
CVE-2025-6349
MEDIUM 5.1
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
|
CVE-2025-2879
MEDIUM 5.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driv… |
|
CVE-2025-64505
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.… |
|
CVE-2025-60722
MEDIUM 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over… |
|
CVE-2025-47370
MEDIUM 6.5
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan. |
|
CVE-2025-47967
MEDIUM 4.7
Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2025-3212
MEDIUM 5.3
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
|
CVE-2025-48560
MEDIUM 5.5
In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure w… |
|
CVE-2025-48559
MEDIUM 5.5
In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denia… |
|
CVE-2025-48529
MEDIUM 5.5
In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local infor… |
|
CVE-2025-26423
MEDIUM 6.2
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to … |
|
CVE-2025-56139
MEDIUM 5.3
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original … |
|
CVE-2025-49755
MEDIUM 4.3
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2025-49736
MEDIUM 4.3
The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2025-21259
MEDIUM 5.3
Microsoft Outlook Spoofing Vulnerability |
|
CVE-2025-21253
MEDIUM 5.3
Microsoft Edge for IOS and Android Spoofing Vulnerability |
|
CVE-2024-50302
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds… |
|
CVE-2024-43604
MEDIUM 5.7
Outlook for Android Elevation of Privilege Vulnerability |
|
CVE-2024-39891
MEDIUM 5.3
KEV
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-numb… |
|
CVE-2024-34130
MEDIUM 5.5
Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature … |
|
CVE-2024-26196
MEDIUM 4.3
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability |
|
CVE-2024-26167
MEDIUM 4.3
Microsoft Edge for Android Spoofing Vulnerability |
|
CVE-2024-26188
MEDIUM 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability |
|
CVE-2024-24699
MEDIUM 6.5
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access. |
|
CVE-2024-24698
MEDIUM 4.9
Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. |
|
CVE-2024-24690
MEDIUM 5.4
Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
|
CVE-2023-49646
MEDIUM 6.4
Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access. |
|
CVE-2023-43583
MEDIUM 4.9
Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user … |
|
CVE-2023-45866
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-43582
MEDIUM 5.5
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
|
CVE-2023-39205
MEDIUM 4.3
Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
|
CVE-2023-39204
MEDIUM 4.3
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
|
CVE-2023-39199
MEDIUM 4.9
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
|
CVE-2023-36029
MEDIUM 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability |
|
CVE-2022-20917
MEDIUM 4.3
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attack… |
|
CVE-2023-39218
MEDIUM 6.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access. |
|
CVE-2023-36532
MEDIUM 5.9
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access. |
|
CVE-2023-26083
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-25012
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.