CVE Tools
Track your stack

Android

9,246 CVEs tracked. 39 of them are in CISA KEV.

This hub aggregates every CVE we track for Android, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Android CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Android CVEs per month
MonthCVEs
2024-11129
2024-1258
2025-0184
2025-0242
2025-0317
2025-0417
2025-0521
2025-0612
2025-0715
2025-0834
2025-09190
2025-1014
2025-1115
2025-12116
2026-0132
2026-0216
2026-03107
2026-0411
2026-0513
2026-06127
2026-070
2026-0818
2026-09206
2026-1034

Severity

How the 9,246 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical7909%
  • High3,98743%
  • Medium4,19245%
  • Low2763%

Latest CVEs

The 15 most recently published vulnerabilities affecting Android.

  1. CVE-2026-56952In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System executi...6.7
  2. CVE-2026-56936In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution ...6.8
  3. CVE-2026-56906In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interact...7.0
  4. CVE-2026-55330In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution pr...9.8
  5. CVE-2026-55307In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with System execution privile...4.4
  6. CVE-2026-0198In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User...4.4
  7. CVE-2026-28648In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...7.8
  8. CVE-2026-28647In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no addition...7.8
  9. CVE-2026-28641In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of ...7.8
  10. CVE-2026-28640In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privil...7.8
  11. CVE-2026-28625In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User ...7.8
  12. CVE-2026-58880In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution pr...7.0
  13. CVE-2026-58865In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution pri...7.5
  14. CVE-2026-58859In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User intera...7.8
  15. CVE-2026-58856In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no add...3.3

Product grouping is registry-driven, with AI assist and human review. How it works