CWE-362
CWE-362 · 170 records · 57 with a public proof-of-concept
Records the NVD classes under CWE-362, highest CVSS first.
- CRITICAL 9.1CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 …
- HIGH 8.8CVE-2026-121079
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-70250
Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.
- HIGH 8.8CVE-2026-106255
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.8CVE-2026-106201public PoC
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- HIGH 8.8CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider…
struts
- HIGH 8.5CVE-2026-106500public PoC
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission t…
- HIGH 8.3CVE-2026-121230
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
chrome
- HIGH 8.3CVE-2026-109757
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- HIGH 8.3CVE-2026-106426
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.3CVE-2026-106377
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 8.3CVE-2026-106238
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome
- HIGH 8.2CVE-2026-61854public PoC
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked…
- HIGH 8.1CVE-2026-58857
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- HIGH 8.1CVE-2026-117618
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administra…
jenkins
- HIGH 8.1CVE-2026-94300
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…
- HIGH 8.1CVE-2026-88174
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- HIGH 8.1CVE-2026-69830
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
- HIGH 8.1CVE-2026-104970public PoC
Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without …
- HIGH 8.1CVE-2026-79625
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker…
- HIGH 8.1CVE-2026-77762
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0…
- HIGH 8.1CVE-2026-61628public PoC
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-th…
- HIGH 7.8CVE-2026-86961
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
- HIGH 7.8CVE-2026-86562
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
- HIGH 7.8CVE-2026-103568
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-84271
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.
guardium data protection
- HIGH 7.7CVE-2026-111770public PoC
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Ser…
- HIGH 7.7CVE-2026-82416public PoC
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In thi…
- HIGH 7.5CVE-2026-103112
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard aut…
- HIGH 7.5CVE-2026-121957public PoC
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending c…
freerdp
- HIGH 7.5CVE-2026-70183
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- HIGH 7.5CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauth…
- HIGH 7.5CVE-2026-100227
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to …
- HIGH 7.5CVE-2026-84230
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
guardium data protection
- HIGH 7.5CVE-2026-104057public PoC
Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write the…
- HIGH 7.5CVE-2026-95280
Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome
- HIGH 7.5CVE-2026-100805
Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
- HIGH 7.4CVE-2026-17337
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted wit…
- HIGH 7.4CVE-2026-59045
In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
android
- HIGH 7.4CVE-2026-59043
In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…
android
- HIGH 7.4CVE-2026-59042
In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
android
- HIGH 7.1CVE-2026-77633public PoC
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outsid…
- HIGH 7CVE-2026-78118public PoC
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential…
- HIGH 7CVE-2026-101311
The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the…
- HIGH 7CVE-2026-101310
The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by th…
- HIGH 7CVE-2026-101309
The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the…
- HIGH 7CVE-2026-58100
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's…
freebsd
- HIGH 7CVE-2026-58099
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while …
freebsd
- HIGH 7CVE-2026-97787
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2022
- HIGH 7CVE-2026-96949
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-96932
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-96919
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7CVE-2026-96215
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2
- HIGH 7CVE-2026-88160
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-88146
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-88107
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-88096
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-87710
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-85941
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85912
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85904
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-85825
Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-85824
Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1
- HIGH 7CVE-2026-85357
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-85329
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-84014
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7CVE-2026-83899
Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83879
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83868
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83841
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83775
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83738
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83722
Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83666
Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-81971
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-70169
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-69935
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7CVE-2026-69931
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- HIGH 7CVE-2026-69856
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-69766
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-69763
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-69736
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-102211
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-102207
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-56906
In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- HIGH 7CVE-2026-105773
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privile…
- HIGH 7CVE-2026-58880
In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…
android
- MEDIUM 6.8CVE-2026-123804public PoC
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert th…
- MEDIUM 6.8CVE-2026-19178
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
- MEDIUM 6.7CVE-2026-58927
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a t…
- MEDIUM 6.7CVE-2026-85333
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 6.7CVE-2026-19571public PoC
The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only afterwards checked the pr…
- MEDIUM 6.5CVE-2026-118128public PoC
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attac…
- MEDIUM 6.5CVE-2026-100394public PoC
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-v…
- MEDIUM 6.5CVE-2026-109954public PoC
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets …
- MEDIUM 6.5CVE-2026-47620public PoC
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service.
dynamo · linux kernel
- MEDIUM 6.4CVE-2026-71347
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.
- MEDIUM 6.4CVE-2026-47565public PoC
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trigger a race condition that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial o…
- MEDIUM 6.4CVE-2026-100546public PoC
OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after a…
- MEDIUM 6.3CVE-2026-96456public PoC
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authent…
- MEDIUM 5.9CVE-2026-92694public PoC
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map…
- MEDIUM 5.9CVE-2026-121963public PoC
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then cl…
freerdp
- MEDIUM 5.9CVE-2026-121961public PoC
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to f…
freerdp
- MEDIUM 5.9CVE-2026-59020
In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.
android
- MEDIUM 5.9CVE-2026-101182
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
- MEDIUM 5.9CVE-2026-116403
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a throu…
- MEDIUM 5.9CVE-2026-85248public PoC
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java…
- MEDIUM 5.9CVE-2026-111449public PoC
Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's…
- MEDIUM 5.9CVE-2026-48154public PoC
GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP …
- MEDIUM 5.6CVE-2026-70097
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.
- MEDIUM 5.5CVE-2026-116119public PoC
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remot…
- MEDIUM 5.4CVE-2026-117507public PoC
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix …
- MEDIUM 5.4CVE-2026-116476public PoC
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from…
- MEDIUM 5.4CVE-2026-113707public PoC
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from…
- MEDIUM 5.3CVE-2026-124622public PoC
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 w…
- MEDIUM 5.3CVE-2026-121408public PoC
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP serv…
freerdp
- MEDIUM 5.3CVE-2026-112708
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.
macos
- MEDIUM 5.3CVE-2026-109945public PoC
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context…
- MEDIUM 5.3CVE-2026-42698
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
- MEDIUM 5.3CVE-2026-106385
Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
- MEDIUM 5.3CVE-2026-105163public PoC
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be l…
- MEDIUM 5.3CVE-2026-105112public PoC
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with o…
- MEDIUM 5.3CVE-2026-95384
Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 5.3CVE-2026-15890public PoC
The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/aead_get.c, stores its nonce counter in unsynchronized function-local static variabl…
- MEDIUM 5.3CVE-2026-94043public PoC
A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiat…
- MEDIUM 5.3CVE-2026-73463
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by…
- MEDIUM 4.8CVE-2026-112556
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.
macos
- MEDIUM 4.8CVE-2026-19936public PoC
The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_…
- MEDIUM 4.7CVE-2026-113896
A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive us…
- MEDIUM 4.7CVE-2026-86915
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.
- MEDIUM 4.7CVE-2026-65372
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.
- MEDIUM 4.7CVE-2026-70195
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
- MEDIUM 4.6CVE-2026-116263public PoC
A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack…
- MEDIUM 4.3CVE-2026-106213
Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
chrome
- MEDIUM 4.3CVE-2026-103282public PoC
Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with…
- MEDIUM 4.2CVE-2026-95772
A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.
- MEDIUM 4.2CVE-2026-118030
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate…
- MEDIUM 4.2CVE-2026-78117public PoC
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and populated that descri…
- MEDIUM 4.2CVE-2026-109779
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- MEDIUM 4.2CVE-2026-109776
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- MEDIUM 4.2CVE-2026-109765
Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- MEDIUM 4.2CVE-2026-109719
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- MEDIUM 4.2CVE-2026-108830public PoC
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The…
- MEDIUM 4.2CVE-2026-105140public PoC
Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memb…
- MEDIUM 4CVE-2026-93694
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-…
- LOW 3.7CVE-2026-123128
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneo…
- LOW 3.7CVE-2026-88814
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple …
- LOW 3.7CVE-2026-121628public PoC
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, …
- LOW 3.7CVE-2026-117499public PoC
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, …
- LOW 3.7CVE-2026-111404
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a…
- LOW 3.7CVE-2026-82390public PoC
The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (default 4) independent sessions, each carrying its own key and direction. The AES peripheral, however, h…
- LOW 3.7CVE-2026-116121public PoC
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requ…
- LOW 3.7CVE-2026-114641public PoC
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send con…
traefik
- LOW 3.7CVE-2026-42689
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
- LOW 3.7CVE-2026-39601
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.
- LOW 3.1CVE-2026-116215public PoC
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass…
- LOW 3.1CVE-2026-109407public PoC
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The a…
- LOW 3.1CVE-2026-92628
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned u…
gitlab
- LOW 3.1CVE-2026-91723
Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
chrome
- LOW 2.5CVE-2026-58926
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker…
android
- LOW 2.5CVE-2026-109279public PoC
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacke…
- UNSCOREDCVE-2026-115402
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
- UNSCOREDCVE-2026-115567public PoC
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the…
- UNSCOREDCVE-2026-82942public PoC
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the hands…
- UNSCOREDCVE-2026-94584
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to proce…
- UNSCOREDCVE-2026-94583
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a reques…
- UNSCOREDCVE-2026-107276public PoC
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP valu…
- UNSCOREDCVE-2026-104855public PoC
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Stor…
- UNSCOREDCVE-2026-103651public PoC
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was …
- UNSCOREDCVE-2026-101041public PoC
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The original implementation verified the token non…