CVEs published in November 2026
8,038 vulnerabilities, 689 critical, 12 exploited.
- google androidIn AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a...9.8 Critical
- google androidIn edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a...7.8 High
- google androidIn CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale...8.4 High
:unknown:AndroidIn arm_lpae_init_pte of io-pgtable-arm-common.c, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges neede…No score- google androidIn EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a...5.3 Medium
- google androidIn on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a...8.4 High
- google androidIn multiple locations, there is a possible way to modify authenticated coprocessor firmware in...6.4 Medium
- google androidIn getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission...4.0 Medium
- google androidIn smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct...6.7 Medium
- google androidIn smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm...7.8 High
- google androidIn multiple locations, there is a possible way to trigger an out of bounds read via an...2.3 Low
- google androidIn port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could...7.0 High
- google androidIn km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic...4.0 Medium
- google androidIn arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic...7.8 High
- google androidIn RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer...7.8 High
- google androidIn smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer...8.4 High
- google androidIn TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security...7.8 High
- google androidIn multiple functions of PssSubscriptionManager.java, there is a possible way to spoof...8.4 High
- google androidIn PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity...8.8 High
- google androidIn _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double...7.8 High
- google androidIn ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic...7.8 High
- google androidIn handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to...6.7 Medium
- google androidIn multiple locations, there is a possible way to trigger an out of bounds read and write in...8.4 High
- google androidIn multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control...6.7 Medium
- google androidIn multiple locations, there is a possible information disclosure due to a logic error in the...4.0 Medium
:unknown:AndroidIn smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to trigger an out of bounds write in hypervisor memory due to improper input validation. This could lead to local escalation of privi…No score- google androidIn aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over...8.4 High
- google androidIn multiple functions of attestation_object.c, there is a possible way to disclose uninitialized...4.0 Medium
:unknown:AndroidIn multiple locations, there is a possible way to bypass fingerprint lockout enforcement in the trusted application due to a logic error. This could lead to local escalation of privilege with no addit…No score:unknown:AndroidIn gf_validate_calibration_package of trusty/vendor/goodix/g7/goodix/main/gf_tee_internal_api.c, there is a possible Buffer Overflow due to a heap buffer overflow. This could lead to local escalation…No score- google androidIn ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry...6.7 Medium
:unknown:AndroidIn multiple functions of vaddr_list.c, there is a possible way to create overlapping memory mappings via an aligned size wraparound due to an integer overflow. This could lead to local escalation of p…No score- google androidIn multiple files, there is a possible out-of-bounds write due to a missing bounds check. This...9.8 Critical
- google androidIn secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass...8.4 High
:unknown:AndroidIn dsim_read_data of secure_dsim_drv.c, there is a possible way to trigger an out of bounds write during short display reads due to an incorrect bounds check. This could lead to local escalation of pr…No score- google androidIn GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out...2.3 Low
- google androidIn km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds...6.7 Medium
:unknown:AndroidIn TOS_SecureBuffer_CheckSize of secure_buffer.c, there is a possible way to bypass secure buffer size validation via an unknown handle due to an incorrect bounds check. This could lead to local escal…No score- google androidIn TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic...7.8 High
- google androidIn multiple locations, there is a possible use-after-free due to a logic error in the code. This...9.8 Critical
:unknown:AndroidIn multiple functions of smmu.c, there is a possible way to flush stream table cache lines at an incorrect offset due to a confused deputy. This could lead to local escalation of privilege with no add…No score- google androidIn parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic...7.8 High
- google androidIn thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread...8.4 High
- google androidIn handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the...6.8 Medium
- google androidIn insert_node of remap.c, there is a possible way to trigger an out of bounds write in the...7.8 High
- google androidIn N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the...8.4 High
- google androidIn multiple functions of verifier.rs, there is a possible way to bypass secure boot signature...8.4 High
- google androidIn handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access...6.4 Medium
- google androidIn rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow...5.3 Medium
- google androidIn multiple functions in multiple locations, there is a possible execution of sensitive USSD...8.4 High
- Show moreLoading…