2025 CVEs (page 193)
Page 193 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48522 | High | 7.8 | 2025-09-04 | In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to… |
CVE-2025-32350 | High | 7.8 | 2025-09-04 | In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This coul… |
CVE-2025-32349 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no ad… |
CVE-2025-32347 | High | 7.8 | 2025-09-04 | In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to l… |
CVE-2025-32346 | High | 7.8 | 2025-09-04 | In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local… |
CVE-2025-32345 | High | 7.8 | 2025-09-04 | In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app sc… |
CVE-2025-32333 | High | 7.8 | 2025-09-04 | In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lead to local escala… |
CVE-2025-32332 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execu… |
CVE-2025-32331 | High | 7.8 | 2025-09-04 | In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local es… |
CVE-2025-32330 | Medium | 5.7 | 2025-09-04 | In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. T… |
CVE-2025-32327 | High | 7.8 | 2025-09-04 | In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local escalation of privile… |
CVE-2025-32326 | High | 7.8 | 2025-09-04 | In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to lo… |
CVE-2025-32325 | High | 7.8 | 2025-09-04 | In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no ad… |
CVE-2025-32324 | High | 7.8 | 2025-09-04 | In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation o… |
CVE-2025-32323 | High | 7.8 | 2025-09-04 | In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper… |
CVE-2025-32321 | High | 7.8 | 2025-09-04 | In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local… |
CVE-2025-26464 | High | 7.8 | 2025-09-04 | In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-26454 | High | 7.8 | 2025-09-04 | In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could… |
CVE-2025-22441 | High | 7.3 | 2025-09-04 | In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to… |
CVE-2025-0089 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege wi… |
CVE-2025-0076 | Low | 3.3 | 2025-09-04 | In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information… |
CVE-2025-32312 | High | 7.8 | 2025-09-04 | In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process d… |
CVE-2025-26463 | Medium | 5.5 | 2025-09-04 | In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This could lead to a local persistent denial… |
CVE-2025-26462 | High | 7.8 | 2025-09-04 | In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of… |
CVE-2025-26458 | High | 7.8 | 2025-09-04 | In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-26456 | Medium | 5.5 | 2025-09-04 | In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error in the code. This could lead to local per… |
CVE-2025-26455 | High | 7.8 | 2025-09-04 | In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privi… |
CVE-2025-26453 | Medium | 5.5 | 2025-09-04 | In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. This could lead to loc… |
CVE-2025-26452 | High | 7.8 | 2025-09-04 | In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. This could lead to loc… |
CVE-2025-26450 | High | 7.8 | 2025-09-04 | In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the default IME due to a mi… |
CVE-2025-26449 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… |
CVE-2025-26448 | Medium | 5.5 | 2025-09-04 | In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no… |
CVE-2025-26445 | Medium | 5.5 | 2025-09-04 | In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead to local information… |
CVE-2025-26444 | High | 7.8 | 2025-09-04 | In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant applicat… |
CVE-2025-26443 | High | 7.3 | 2025-09-04 | In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in th… |
CVE-2025-26442 | Medium | 5.5 | 2025-09-04 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due to a logic error in… |
CVE-2025-26441 | Medium | 6.5 | 2025-09-04 | In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no… |
CVE-2025-26440 | High | 7.8 | 2025-09-04 | In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local… |
CVE-2025-26438 | High | 8.8 | 2025-09-04 | In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. Th… |
CVE-2025-26437 | Medium | 5.5 | 2025-09-04 | In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check… |
CVE-2025-26436 | High | 7.8 | 2025-09-04 | In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypa… |
CVE-2025-26435 | High | 7.8 | 2025-09-04 | In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app sc… |
CVE-2025-26432 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could lead to local denial of service with no… |
CVE-2025-26430 | High | 7.8 | 2025-09-04 | In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalati… |
CVE-2025-26429 | Medium | 5.5 | 2025-09-04 | In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of servic… |
CVE-2025-26428 | Low | 3.2 | 2025-09-04 | In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalatio… |
CVE-2025-26427 | Medium | 4.4 | 2025-09-04 | In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no addition… |
CVE-2025-26426 | Medium | 5.1 | 2025-09-04 | In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper… |
CVE-2025-26425 | Medium | 4.0 | 2025-09-04 | In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local es… |
CVE-2025-26424 | Medium | 4.0 | 2025-09-04 | In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information discl… |
CVE-2025-26423 | Medium | 6.2 | 2025-09-04 | In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to… |
CVE-2025-26422 | Medium | 4.0 | 2025-09-04 | In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could… |
CVE-2025-26421 | Medium | 4.0 | 2025-09-04 | In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additi… |
CVE-2025-26420 | Medium | 4.4 | 2025-09-04 | In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission ove… |
CVE-2025-22425 | Medium | 5.1 | 2025-09-04 | In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2025-0087 | Medium | 5.1 | 2025-09-04 | In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to loca… |
CVE-2025-0077 | Medium | 4.0 | 2025-09-04 | In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege… |
CVE-2025-9636 | High | 7.9 | 2025-09-04 | pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potential… |
CVE-2025-57576 | Medium | 5.4 | 2025-09-04 | PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php. |
CVE-2025-38730 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only… |
CVE-2025-38729 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptor… |
CVE-2025-38728 | Critical | 9.1 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to… |
CVE-2025-38727 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for… |
CVE-2025-38726 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect After the c… |
CVE-2025-38725 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax… |
CVE-2025-38724 | Critical | 9.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently r… |
CVE-2025-38723 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_com… |
CVE-2025-38722 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into des… |
CVE-2025-38721 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in… |
CVE-2025-38720 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: hibmcge: fix rtnl deadlock issue Currently, the hibmcge netdev acquires the rtnl_loc… |
CVE-2025-38719 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: hibmcge: fix the division by zero issue When the network port is down, the queue is… |
CVE-2025-38718 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag… |
CVE-2025-38717 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_una… |
CVE-2025-38716 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix general protection fault in hfs_find_init() The hfs_find_init() method can trigg… |
CVE-2025-38715 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_val… |
CVE-2025-38714 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method c… |
CVE-2025-38713 | High | 7.1 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is… |
CVE-2025-38712 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header co… |
CVE-2025-38711 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is cal… |
CVE-2025-38710 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that en… |
CVE-2025-38709 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer wh… |
CVE-2025-38708 | Critical | 9.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD t… |
CVE-2025-38707 | High | 7.1 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller th… |
CVE-2025-38706 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runt… |
CVE-2025-38705 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix null pointer access Writing a string without delimiters (' ', '\n', '\0')… |
CVE-2025-38704 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation s… |
CVE-2025-38703 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data… |
CVE-2025-38702 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementat… |
CVE-2025-38701 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image trigge… |
CVE-2025-38700 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an… |
CVE-2025-38699 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization… |
CVE-2025-38698 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a… |
CVE-2025-38697 | High | 7.8 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllo… |
CVE-2025-38696 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI… |
CVE-2025-38695 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lp… |
CVE-2025-38694 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw… |
CVE-2025-38693 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_t… |
CVE-2025-38692 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following c… |
CVE-2025-38691 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt t… |
CVE-2025-38690 | Medium | 5.5 | 2025-09-04 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XE_CAHEL… |