Samsung Mobile vulnerabilities
1,419 CVEs and advisories name Samsung Mobile as an affected vendor, 13 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-21021Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.
- CVE-2026-21020Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged func
- CVE-2026-21019Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code w
- CVE-2026-21018Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
- CVE-2026-21016Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
- CVE-2026-21015Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.
- CVE-2026-21023Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local attackers to modify the
- CVE-2026-21010Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.
- CVE-2026-21008Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.
- CVE-2026-21014Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data.
- CVE-2026-21013Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information.
- CVE-2026-21012External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system priv
- CVE-2026-21011Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend U
- CVE-2026-21009Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.
- CVE-2026-21007Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.
- CVE-2026-21006Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.
- CVE-2026-21003Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the re
- CVE-2026-21005Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege
- CVE-2026-21004Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.
- CVE-2026-21002Improper verification of cryptographic signature in Galaxy Store prior to version 4.6.03.8 allows local attacker to install arbitrary applic
- CVE-2026-21001Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.
- CVE-2026-21000Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege.
- CVE-2026-20999Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.
- CVE-2026-20998Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
- CVE-2026-20997Improper verification of cryptographic signature in Smart Switch prior to version 3.7.69.15 allows remote attackers to potentially bypass au
- CVE-2026-20996Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.69.15 allows remote attackers to configure a downgrade
- CVE-2026-20995Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a spe
- CVE-2026-20994URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.
- CVE-2026-20993Improper export of android application components in Samsung Assistant prior to version 9.3.10.7 allows local attacker to access saved infor
- CVE-2026-20992Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of