2,760 results · Feed
-
High 8.4
In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalat…
-
High 8.4
In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This coul…
-
Critical 9.8
In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. …
-
Low 2.1
In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could l…
-
Critical 9.8
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code exec…
-
Critical 9.8
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. Thi…
-
High 7.4
In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local e…
-
Critical 9.8
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. Thi…
-
Critical 9.8
In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote…
-
High 7.5
In dhd_tcpdata_info_get of dhd_ip.c, there is a possible Denial of Service due to a precondition check failure. This co…
-
Medium 4.0
The register protection of the PowerVR GPU is incorrectly configured. This could lead to local information disclosure w…
-
High 8.4
In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. T…
-
High 8.4
In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validati…
-
Critical 10.0
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead …
-
High 8.4
In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a pat…
-
High 8.8
In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from…
-
High 8.4CVE-2026-0047 Public exploit
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information du…
-
High 8.4
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the c…
-
High 8.4
In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead…
-
High 8.4
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing fi…
-
High 8.4
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper…
-
High 7.8
In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This …
-
High 8.4
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could …
-
High 8.4
In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds c…
-
High 8.4
In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to…
-
High 8.4
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This c…
-
Medium 6.7
In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead t…
-
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due…
-
High 8.4
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypas…
-
Medium 4.0
In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of …
-
High 7.8CVE-2026-0023 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…
-
High 8.4
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a …
-
High 8.4
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain per…
-
High 7.7
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the …
-
Medium 6.2
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input val…
-
Medium 6.2CVE-2026-0014 Public exploit
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input …
-
High 8.4CVE-2026-0013 Public exploit
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…
-
Medium 6.2
In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error i…
-
High 8.4
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a lo…
-
High 8.4CVE-2026-0010 Public exploit
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This co…