Vulnerabilities
Tracked app vulnerabilities
49 CVEs affect a tracked app or OS (Low, Android). 0 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 49
- Actively exploited
- 0
- Publication window
- 2015-07-23 → 2026-10-05
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-58856
LOW 3.3
In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to lo… |
|
CVE-2026-55290
LOW 3.3
In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with … |
|
CVE-2026-49895
LOW 3.5
In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (… |
|
CVE-2026-45525
LOW 3.3
In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no… |
|
CVE-2026-45521
LOW 3.3
In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosur… |
|
CVE-2026-45519
LOW 3.3
In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local i… |
|
CVE-2026-28671
LOW 3.3
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure … |
|
CVE-2026-28660
LOW 3.3
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with… |
|
CVE-2026-28652
LOW 3.1
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure … |
|
CVE-2026-28638
LOW 3.3
In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local informat… |
|
CVE-2026-28630
LOW 3.3
In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure… |
|
CVE-2026-28623
LOW 3.3
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could … |
|
CVE-2026-28622
LOW 3.3
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local i… |
|
CVE-2026-28582
LOW 3.3
In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permiss… |
|
CVE-2026-0054
LOW 3.3
In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead… |
|
CVE-2026-28586
LOW 3.3
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information dis… |
|
CVE-2026-0056
LOW 3.3
In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no… |
|
CVE-2026-0050
LOW 3.3
In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This could lead to local in… |
|
CVE-2026-0016
LOW 3.3
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. T… |
|
CVE-2025-48616
LOW 3.3
In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This… |
|
CVE-2025-49462
LOW 3.5
Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. |
|
CVE-2024-26246
LOW 3.9
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
|
CVE-2023-39206
LOW 3.7
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
|
CVE-2023-28301
LOW 3.7
Microsoft Edge (Chromium-based) Tampering Vulnerability |
|
CVE-2022-36835
LOW 3.3
Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files. |
|
CVE-2021-41861
LOW 3.3
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. Aft… |
|
CVE-2021-3655
LOW 3.3
A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uni… |
|
CVE-2020-29374
LOW 3.6
An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for … |
|
CVE-2020-1905
LOW 3.3
Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have all… |
|
CVE-2018-12446
LOW 3.6
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation t… |
|
CVE-2018-12445
LOW 3.1
An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biometric validation allows authentication … |
|
CVE-2017-9694
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-9693
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-9692
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-9681
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-9680
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-9679
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0751
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0748
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0744
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0709
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-8241
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0651
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0650
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0635
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0499
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2017-0452
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2016-6690
LOW · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2015-1283
LOW · vendor
+1
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote … |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.