Android
9,541 CVEs tracked. 39 of them are in CISA KEV.
This hub aggregates every CVE we track for Android, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Android CVEs per month
| Month | CVEs |
|---|---|
| 2024-12 | 58 |
| 2025-01 | 84 |
| 2025-02 | 42 |
| 2025-03 | 17 |
| 2025-04 | 17 |
| 2025-05 | 21 |
| 2025-06 | 12 |
| 2025-07 | 15 |
| 2025-08 | 34 |
| 2025-09 | 190 |
| 2025-10 | 14 |
| 2025-11 | 15 |
| 2025-12 | 116 |
| 2026-01 | 32 |
| 2026-02 | 16 |
| 2026-03 | 107 |
| 2026-04 | 11 |
| 2026-05 | 13 |
| 2026-06 | 127 |
| 2026-07 | 0 |
| 2026-08 | 18 |
| 2026-09 | 206 |
| 2026-10 | 34 |
| 2026-11 | 295 |
Severity
How the 9,541 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical809
- High4,146
- Medium4,289
- Low295
Latest CVEs
The 15 most recently published vulnerabilities affecting Android.
- CVE-2026-95405In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of...8.4
- CVE-2026-95404In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to local escalation of pr...6.7
- CVE-2026-95403In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing bounds check. This could lead to local escalation of privilege...8.4
- CVE-2026-95402In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User inter...7.8
- CVE-2026-95401In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User...7.8
- CVE-2026-95400In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect bounds check. This could lead to local escalation of privilege...8.4
- CVE-2026-95399In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privile...6.4
- CVE-2026-95397In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed...7.8
- CVE-2026-59637In userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User inte...3.3
- CVE-2026-59636In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could le...6.2
- CVE-2026-59635In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction...7.8
- CVE-2026-59632In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue due to a type confusion. This could lead to remote denial ...7.5
- CVE-2026-59631In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User i...7.8
- CVE-2026-59630In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due to a logic error. This could lead to local escalation of...8.4
- CVE-2026-59628In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decoder command queue due to a logic error. This could lead to local information di...4.0
Product grouping is registry-driven, with AI assist and human review. How it works