Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,154 results · page 15 of 224
Jun 17, 2026In SettingsLib, there is a possible missing permission check due to a logic error in the code.CVE-2026-0071 · Computers, phones & browsers · Google · reported by security@android.comCritical 10
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync CVE-2026-0068 · Computers, phones & browsers · Google · reported by security@android.comCritical 10
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In multiple places, there is a possible persistent denial of service due to resource exhaustion.CVE-2026-0064 · Computers, phones & browsers · Google · reported by security@android.comCritical 10
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code.CVE-2026-0063 · Computers, phones & browsers · Google · reported by security@android.comCritical 10
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check.CVE-2026-0057 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In SettingsLib, there is a possible way to disable system components due to a logic error in the code.CVE-2026-0019 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Jun 17, 2026In multiple locations there is a possible provisioning bypass due to improper input validation.CVE-2025-48643 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check.CVE-2025-48640 · Computers, phones & browsers · Google · reported by security@android.comHigh 8
In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass.CVE-2025-48617 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code.CVE-2025-48571 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.3
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled conteCVE-2026-12348 · Other software · The Browser Company of New York` · reported by 59469e6c-7ea7-446f-8e43-06aa32c115e8High 7.4
Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.
- Product
- Arc Search
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check.CVE-2026-0165 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.5
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Modem, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0164 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion.CVE-2026-0162 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow.CVE-2026-0161 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0160 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Camera, there is a possible unauthorized way to access photos due to a missing permission check.CVE-2026-0158 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check.CVE-2026-0157 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4.3
In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check.CVE-2026-0156 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check.CVE-2026-0155 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.3
In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption.CVE-2026-0154 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check.CVE-2026-0153 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic errCVE-2026-0152 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow.CVE-2026-0151 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow.CVE-2026-0150 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with root privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow.CVE-2026-0149 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow.CVE-2026-0148 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0147 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0146 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In keymint, there is a possible Permission Bypass due to a logic error in the code.CVE-2026-0145 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check.CVE-2026-0144 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free.CVE-2026-0143 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation.CVE-2026-0142 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check.CVE-2026-0141 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.3
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow.CVE-2026-0140 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4.3
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Modem, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0139 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption.CVE-2026-0138 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free.CVE-2026-0137 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Modem, there is a possible out of bounds read due to a missing bounds check.CVE-2026-0136 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Modem, there is a possible out of bounds read due to a missing bounds check.CVE-2026-0135 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code.CVE-2026-0134 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4
In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check.CVE-2026-0133 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In Modem, there is a possible out of bounds write due to a heap buffer overflow.CVE-2026-0132 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.8
In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow.CVE-2026-0131 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.3
In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow.CVE-2026-0130 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4.3
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check.CVE-2026-0129 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 4.3
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow.CVE-2026-0128 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.5
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption.CVE-2026-0127 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.5
In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In WC-Radio, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0126 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition.CVE-2026-0125 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.