By year
99
00
01
02
03
04
05
06
07
10
12
13
14
15
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Qualcomm flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-21385 Qualcomm Multiple Chipsets Memory CorruptionExploited since Mar 3, 2026 · CVSS 7.8
- CVE-2025-21479 Qualcomm Multiple Chipsets Incorrect AuthorizationExploited since Jun 3, 2025 · CVSS 8.6
- CVE-2025-27038 Qualcomm Multiple Chipsets Use-After-FreeExploited since Jun 3, 2025 · CVSS 7.5
- CVE-2025-21480 Qualcomm Multiple Chipsets Incorrect AuthorizationExploited since Jun 3, 2025 · CVSS 8.6
- CVE-2024-43047 Qualcomm Multiple Chipsets Use-After-FreeExploited since Oct 8, 2024 · CVSS 7.8
- CVE-2023-33107 Qualcomm Multiple Chipsets Integer OverflowExploited since Dec 5, 2023 · CVSS 8.4
- CVE-2023-33106 Qualcomm Multiple Chipsets Use of Out-of-Range Pointer OffsetExploited since Dec 5, 2023 · CVSS 8.4
- CVE-2023-33063 Qualcomm Multiple Chipsets Use-After-FreeExploited since Dec 5, 2023 · CVSS 7.8
- CVE-2022-22071 Qualcomm Multiple Chipsets Use-After-FreeExploited since Dec 5, 2023 · CVSS 8.4
- CVE-2020-11261 Qualcomm Multiple Chipsets Improper Input ValidationExploited since Dec 1, 2021 · CVSS 7.8
- CVE-2021-1906 Qualcomm Multiple Chipsets Detection of Error Condition Without ActionExploited since Nov 3, 2021 · CVSS 6.2
- CVE-2021-1905 Qualcomm Multiple Chipsets Use-After-FreeExploited since Nov 3, 2021 · CVSS 8.4
Latest high and critical flaws
- CVE-2026-57559 Memory corruption while processing service requests.High 7.8 · Oct 6, 2026
- CVE-2026-57555 Memory Corruption when executing system service routines due to improper handling of user input buffers.High 7.8 · Oct 6, 2026
- CVE-2026-57554 Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.High 7.8 · Oct 6, 2026
- CVE-2026-57546 Transient DOS when processing a continuous receive command with a zero-sized global configuration override.High 7.5 · Oct 6, 2026
- CVE-2026-57545 Memory corruption when processing draw objects of incorrect type during graphics command list execution.High 7.8 · Oct 6, 2026
- CVE-2026-57537 Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.High 7.8 · Oct 6, 2026
- CVE-2026-25302 Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted anHigh 7.1 · Oct 6, 2026
- CVE-2026-25291 Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.High 7.8 · Oct 6, 2026
- CVE-2026-25267 Memory corruption when non-secure loader rewrites page tables before secure memory initialization.High 7.8 · Oct 6, 2026
- CVE-2026-25265 Privilege escalation due to weak configuration while temporary file handling.High 8.8 · Sep 22, 2026
- CVE-2026-25264 Privilege escalation due to weak configuration during package extraction process.High 8.8 · Sep 22, 2026
- CVE-2026-25255 Exposed dangerous function lead to privilege escalation via gRPC server.High 8.8 · Sep 22, 2026
- CVE-2026-25254 Improper authorization leads to Remote Code Execution via SocketIO interface.Critical 9.8 · Sep 22, 2026
- CVE-2026-25294 Transient DOS while parsing frame during channel usage.High 7.4 · Sep 17, 2026
- CVE-2026-25290 Memory Corruption when validating large data buffers from external sources using addition to check buffer length.High 7.8 · Sep 17, 2026
- CVE-2026-25284 Information Disclosure when a pointer is reused after being deallocated.High 7.3 · Sep 17, 2026
- CVE-2026-25283 Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.High 8.8 · Sep 17, 2026
- CVE-2026-25282 Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.High 7.9 · Sep 17, 2026
- CVE-2026-25281 Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.High 7.4 · Sep 17, 2026
- CVE-2026-25280 Memory corruption when processing escape handling flow with insufficient user buffer sizes.High 7.8 · Sep 17, 2026
- CVE-2026-25278 Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.High 7.8 · Sep 17, 2026
- CVE-2026-25275 Transient DOS when processing authentication frames with invalid FILS information element header lengths.High 7.5 · Sep 17, 2026
- CVE-2026-24081 Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.High 7.4 · Sep 17, 2026
- CVE-2026-24075 Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.High 7.8 · Sep 17, 2026
- CVE-2026-24074 Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.High 7.8 · Sep 17, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.