CVE-2026-55317

CVE-2026-55317 is an out-of-bounds write in the printf function of printf.c within the Bootloader component of Google Pixel devices, caused by improper input validation. The flaw allows local privilege escalation to System level without user interaction, though it requires the attacker to already...

CVE-2026-55306

CVE-2026-55306 is an improper input validation flaw in the Cellular Modem of Google Pixel devices, leading to a remote denial of service with no required privileges or user interaction. The Pixel September 2026 bulletin classifies it as Critical severity (CVSS 3.1 base score 7.5, HIGH). CISA's SS...

CVE-2026-55304

CVE-2026-55304 is a local privilege escalation vulnerability in Android, specifically in the addr_remap_address_map function within remap.c . The root cause is a logic error in the code, allowing an attacker with System execution privileges to escalate further without any user interaction. The vu...

CVE-2026-55302

CVE-2026-55302 is a Critical -severity elevation of privilege vulnerability in the Bootloader of Google Pixel devices. The root cause is a permission bypass due to a logic error in multiple locations, allowing an attacker with System -level privileges to escalate further without user interaction....

CVE-2026-55301

CVE-2026-55301 affects the Wave6 VPU driver (Wave6VpuDecFlush in wave6.c) in Android (Pixel) devices. The root cause is a missing bounds check that permits an out-of-bounds write, enabling local privilege escalation with no additional execution privileges and no user interaction required. The CVS...

CVE-2026-0200

CVE-2026-0200 is an out-of-bounds write in the Cellular Modem (Telephony subcomponent) of Google Pixel devices , caused by a heap buffer overflow . This flaw enables remote escalation of privilege without additional execution privileges or user interaction. It is classified as Critical severity a...

CVE-2026-0199

CVE-2026-0199 is a local elevation of privilege vulnerability in the Goodix Fingerprint Trusted Application (TA) on Google Pixel devices. The root cause is an out-of-bounds write in the function gf_ta_test_set_config within gf_ta_test.c, resulting from improper input validation. No additional exe...

CVE-2026-0197

CVE-2026-0197 is a local information disclosure vulnerability in the VPU (Video Processing Unit) component of Android Pixel devices, caused by a logic error in the code. An attacker with System execution privileges can exploit it without user interaction to disclose sensitive information. The vul...

CVE-2026-0194

CVE-2026-0194 is a local privilege escalation vulnerability in the Trusted Execution Environment (TEE) of Google Pixel devices, caused by an integer overflow that permits a permission bypass . No additional execution privileges or user interaction are required for exploitation. The Pixel Update B...

CVE-2026-0192

CVE-2026-0192 is a local privilege escalation vulnerability in the Bootloader of supported Google Pixel devices, caused by a missing permission check . An attacker with System-level execution privileges can exploit it without user interaction to gain higher privileges, resulting in high impact on...

CVE-2026-0189

CVE-2026-0189 is a permission bypass in the ac_init_policy function of init.c within the Bootloader component of Google Pixel devices, caused by a logic error. It enables local escalation of privilege with no additional execution privileges and no user interaction required. The CVSS 3.1 score is ...

CVE-2026-0187

CVE-2026-0187 is a local privilege escalation vulnerability in the GSA (Google Silicon Accelerator) component of Google Pixel devices, specifically in the function gsa_sw_pk_hash_compare in image-auth-srv.c. The root cause is a logic error that allows escalation to System execution privileges wit...

CVE-2026-0186

CVE-2026-0186 is an elevation of privilege vulnerability in the Bootloader of Google Pixel devices, caused by a logic error in the ac_init_one_sswrp function within init.c. An attacker with System -level execution privileges can exploit this locally without user interaction to escalate to higher ...

CVE-2026-0183

CVE-2026-0183 is an information disclosure vulnerability in CPM caused by a confused deputy flaw. An attacker with System execution privileges can exploit it locally without user interaction to achieve high confidentiality impact, while integrity and availability remain unaffected. The CNA-assign...

CVE-2026-0179

CVE-2026-0179 is a Critical -severity elevation-of-privilege vulnerability in the Bootloader of Google Pixel devices, caused by a missing permission check that allows a local attacker with System execution privileges to bypass permissions. No user interaction is required. The vulnerability is tra...

CVE-2026-0177

CVE-2026-0177 is an out-of-bounds read in do_sss_aes_gcm_256_op (crypto-aes.c) caused by a missing bounds check, leading to local information disclosure requiring System privileges and no user interaction. It affects the GSA subcomponent on Pixel devices and is rated Critical in the September 202...

CVE-2026-0171

CVE-2026-0171 is an out-of-bounds write in the BigWave component of Google Pixel devices, caused by a logic error in the code. The vulnerability can lead to remote code execution (classified as EoP/High severity in the Pixel bulletin) with only low privileges required and no user interaction need...

CVE-2026-0170

CVE-2026-0170 is a missing bounds check in Vp9DecodeFrameTag (vp9hwd_headers.cc) that allows an out-of-bounds write , leading to remote privilege escalation with no user interaction. The vulnerability affects the BigOcean subcomponent on supported Google Pixel devices. It is rated CVSS 8.8 (High)...

CVE-2026-0159

CVE-2026-0159 is a remote code execution vulnerability in the Cellular Modem of Google Pixel devices, caused by an out-of-bounds write due to a missing bounds check. It requires only low privileges , no user interaction, and is exploitable over the network (CVSS 3.1 base score 8.8 HIGH ). CISA's ...

CVE-2026-68533

Concrete CMS versions below 9.5.3 have a missing authorization flaw in the conversation attachment upload endpoint. The endpoint imported files into the file manager before checking the "Add Message Attachments" permission, meaning a user lacking that permission—or an unauthenticated visitor on a...