SM
Product
Samsung Mobile devices
On CISA KEVExploited in the wild
866
CVEs
13
On KEV
10.0
Max CVSS
14
New 30D
Severity mix
Critical 45High 275Medium 180Low 0
Watch
Add Samsung Mobile devices to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21015 | 5.5 | May 13 | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier Affected: All versions, or not specified |
| CVE-2026-21023 | 5.5 | Apr 29 | Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the installation restriction of specific… Affected: All versions, or not specified |
| CVE-2026-20977 | 5.5 | Feb 4 | Improper access control in Emergency Sharing prior to SMR Feb-2026 Release 1 allows local attackers to interrupt its functioning Affected: All versions, or not specified |
| CVE-2026-20969 | 5.5 | Jan 9 | Improper input validation in SecSettings prior to SMR Jan-2026 Release 1 allows local attacker to access file with system privilege Affected: All versions, or not specified |
| CVE-2025-21050 | 5.5 | Oct 10 | Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles Affected: All versions, or not specified |
| CVE-2025-21054 | 5.5 | Oct 10 | Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potentially access out-of-bounds memory Affected: All versions, or not specified |
| CVE-2025-21049 | 5.5 | Oct 10 | Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-21045 | 5.5 | Oct 10 | Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-21033 | 5.5 | Sep 3 | Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-21028 | 5.5 | Sep 3 | Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items Affected: All versions, or not specified |
| CVE-2023-21478 | 5.5 | Sep 3 | Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data Affected: All versions, or not specified |
| CVE-2023-21477 | 5.5 | Sep 3 | Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data Affected: All versions, or not specified |
| CVE-2025-21014 | 5.5 | Aug 6 | Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-21012 | 5.5 | Aug 6 | Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration Affected: All versions, or not specified |
| CVE-2025-21011 | 5.5 | Aug 6 | Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body… Affected: All versions, or not specified |
| CVE-2025-21004 | 5.5 | Jul 8 | Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the device Affected: All versions, or not specified |
| CVE-2025-21003 | 5.5 | Jul 8 | Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-21002 | 5.5 | Jul 8 | Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast Affected: All versions, or not specified |
| CVE-2025-21001 | 5.5 | Jul 8 | Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting Auracast Affected: All versions, or not specified |
| CVE-2025-20997 | 5.5 | Jul 8 | Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuration of Galaxy Watch Affected: All versions, or not specified |
| CVE-2025-20986 | 5.5 | Jun 4 | Improper access control in ScreenCapture for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to take screenshots Affected: All versions, or not specified |
| CVE-2025-20961 | 5.5 | May 7 | Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attackers to access files with system… Affected: All versions, or not specified |
| CVE-2025-20959 | 5.5 | May 7 | Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-20955 | 5.5 | May 7 | Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR May-2025 Release 1 allows local attackers to access notification images Affected: All versions, or not specified |
| CVE-2025-20954 | 5.5 | May 7 | Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-20952 | 5.5 | Apr 9 | Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilege Affected: All versions, or not specified |
| CVE-2025-20947 | 5.5 | Apr 8 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access image files across multiple users Affected: All versions, or not specified |
| CVE-2025-20938 | 5.5 | Apr 8 | Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts Affected: All versions, or not specified |
| CVE-2025-20935 | 5.5 | Apr 8 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access files with system privilege Affected: All versions, or not specified |
| CVE-2025-20934 | 5.5 | Apr 8 | Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege Affected: All versions, or not specified |
| CVE-2025-20909 | 5.5 | Mar 6 | Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information Affected: All versions, or not specified |
| CVE-2025-20906 | 5.5 | Feb 4 | Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB Affected: All versions, or not specified |
| CVE-2025-20891 | 5.5 | Feb 4 | Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory Affected: All versions, or not specified |
| CVE-2025-20889 | 5.5 | Feb 4 | Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory Affected: All versions, or not specified |
| CVE-2025-20887 | 5.5 | Feb 4 | Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory Affected: All versions, or not specified |
| CVE-2024-49412 | 5.5 | Dec 3 | Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch Affected: All versions, or not specified |
| CVE-2024-34680 | 5.5 | Nov 6 | Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive information Affected: All versions, or not specified |
| CVE-2024-34673 | 5.5 | Nov 6 | Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service Affected: All versions, or not specified |
| CVE-2024-34663 | 5.5 | Oct 8 | Integer overflow in libSEF.quram.so prior to SMR Oct-2024 Release 1 allows local attackers to write out-of-bounds memory Affected: All versions, or not specified |
| CVE-2024-34655 | 5.5 | Sep 4 | Incorrect use of privileged API in UniversalCredentialManager prior to SMR Sep-2024 Release 1 allows local attackers to access privileged API related to UniversalCredentialManager Affected: All versions, or not specified |
| CVE-2024-34654 | 5.5 | Sep 4 | Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege Affected: All versions, or not specified |
| CVE-2024-34651 | 5.5 | Sep 4 | Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files Affected: All versions, or not specified |
| CVE-2024-34648 | 5.5 | Sep 4 | Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive data Affected: All versions, or not specified |
| CVE-2024-34647 | 5.5 | Sep 4 | Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to knox without proper license Affected: All versions, or not specified |
| CVE-2024-34646 | 5.5 | Sep 4 | Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local permanent denial of service Affected: All versions, or not specified |
| CVE-2024-34644 | 5.5 | Sep 4 | Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data Affected: All versions, or not specified |
| CVE-2024-34643 | 5.5 | Sep 4 | Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data Affected: All versions, or not specified |
| CVE-2024-34637 | 5.5 | Sep 4 | Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to… Affected: All versions, or not specified |
| CVE-2024-34616 | 5.5 | Aug 7 | Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive data Affected: All versions, or not specified |
| CVE-2024-34613 | 5.5 | Aug 7 | Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watch Affected: All versions, or not specified |
The 500 most important CVEs for this product (exploited first, then by severity)