Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9835 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-48606 1 Google 1 Android 2025-12-09 7.8 High
In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-48608 1 Google 1 Android 2025-12-08 5.5 Medium
In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-48569 1 Google 1 Android 2025-12-08 5.5 Medium
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-21080 2 Google, Samsung 4 Android, Android, Dynamic Lockscreen and 1 more 2025-12-05 6.2 Medium
Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege.
CVE-2025-58483 2 Google, Samsung 4 Android, Galaxy Store, Galaxy Watch and 1 more 2025-12-04 5.9 Medium
Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary application on Galaxy Store.
CVE-2025-20789 2 Google, Mediatek 7 Android, Mt6781, Mt6833 and 4 more 2025-12-03 4.4 Medium
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
CVE-2025-20788 2 Google, Mediatek 3 Android, Mt6991, Mt8196 2025-12-03 4.4 Medium
In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117735; Issue ID: MSV-4539.
CVE-2025-61619 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-61618 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-61617 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-61610 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-61609 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-61608 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-61607 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-3012 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In dpc modem, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-11133 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-11132 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-02 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-11131 2 Google, Unisoc 5 Android, T8100, T8200 and 2 more 2025-12-01 7.5 High
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2025-63435 2 Google, Xtooltech 3 Android, Anyscan, Xtool Anyscan 2025-11-28 4.3 Medium
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..
CVE-2025-63434 2 Google, Xtooltech 3 Android, Anyscan, Xtool Anyscan 2025-11-28 8.8 High
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.