Filtered by vendor Google Subscriptions
Filtered by product Android Subscriptions
Total 8732 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-20721 2 Google, Mediatek 15 Android, Iot Yocto, Mt6886 and 12 more 2025-10-15 7.8 High
In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.
CVE-2025-20722 4 Google, Mediatek, Openwrt and 1 more 19 Android, Mt6835, Mt6878 and 16 more 2025-10-15 5.5 Medium
In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.
CVE-2025-20723 2 Google, Mediatek 15 Android, Mt6835, Mt6878 and 12 more 2025-10-15 7.8 High
In gnss driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920033; Issue ID: MSV-3797.
CVE-2025-11717 2 Google, Mozilla 2 Android, Firefox 2025-10-15 9.1 Critical
When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox < 144.
CVE-2025-11718 2 Google, Mozilla 2 Android, Firefox 2025-10-15 6.5 Medium
When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event This vulnerability affects Firefox < 144.
CVE-2025-11720 2 Google, Mozilla 2 Android, Firefox 2025-10-15 8.1 High
The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox < 144.
CVE-2025-59834 3 Adb Mcp Project, Google, Srmorete 3 Adb Mcp, Android, Adb Mcp Server 2025-10-14 9.8 Critical
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.
CVE-2024-20854 2 Google, Samsung 2 Android, Camera 2025-10-10 5.9 Medium
Improper handling of insufficient privileges vulnerability in Samsung Camera prior to versions 12.1.0.31 in Android 12, 13.1.02.07 in Android 13, and 14.0.01.06 in Android 14 allows local attackers to access image data.
CVE-2025-34251 2 Google, Tesla 3 Android, Telematics Control Unit, Tesla 2025-10-08 N/A
Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.
CVE-2025-56466 2 Google, Masterlifecrm 2 Android, Dietly 2025-10-06 7.5 High
Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.
CVE-2025-59407 3 Flock Safety, Flocksafety, Google 6 Bravo Edge Ai Compute Device, Bravo Edge Ai Compute Device, Detectionprocessing and 3 more 2025-10-03 9.8 Critical
The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.
CVE-2025-59405 2 Flocksafety, Google 5 Bravo Edge Ai Compute Device, Falcon, License Plate Reader and 2 more 2025-10-03 7.5 High
The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
CVE-2025-59403 2 Flocksafety, Google 5 Bravo Edge Ai Compute Device, Collins, Falcon and 2 more 2025-10-03 6.5 Medium
The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include but are not limited to: /reboot, /logs, /crashpack, and /adb/enable. This results in multiple impacts including denial of service (DoS) via /reboot, information disclosure via /logs, and remote code execution (RCE) via /adb/enable. The latter specifically results in adb being started over TCP without debugging confirmation, providing an attacker in the LAN/WLAN with shell access.
CVE-2025-59406 3 Flock Safety, Flocksafety, Google 6 Bravo Edge Ai Compute Device, Bravo Edge Ai Compute Device, Falcon and 3 more 2025-10-03 6.2 Medium
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
CVE-2025-20926 2 Google, Samsung 2 Android, Myfiles 2025-10-03 5.5 Medium
Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access files with My Files' privilege.
CVE-2025-21024 2 Google, Samsung 2 Android, Smart View 2025-10-02 3.3 Low
Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information.
CVE-2025-20980 1 Google 1 Android 2025-10-02 4 Medium
Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption.
CVE-2025-20979 1 Google 1 Android 2025-10-02 8.4 High
Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code.
CVE-2023-21482 2 Google, Samsung 4 Android, Camera, Mobile and 1 more 2025-10-01 6.1 Medium
Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical attackers to install package through Galaxy store before completion of Setup wizard.
CVE-2025-47967 2 Google, Microsoft 3 Android, Edge, Edge Chromium 2025-10-01 4.7 Medium
Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.