CWE-362 CVEs | Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3,096 matches · 40 in Waratek scope · 1 protected · 21 exploited · 12 CISA KEV · 113 public PoC · 7 EPSS ≥ 0.5

3,096matches 40in Waratek scope1.3% 1protected0.0% 21exploited0.7% 12CISA KEV0.4% 113public PoC3.6% 7EPSS ≥ 0.50.2%

Protected by Waratek 1 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 39 1.3% Outside Waratek scope 28 0.9% Not applicable 3,028 97.8% Withdrawn CVE 0 0.0%

Critical 83 2.7% High 1,655 53.5% Medium 1,217 39.3% Low 140 4.5% None 0 0.0% Unknown 1 0.0%

blocked by ARMR today 1 0.0% partly blocked 0 0.0% not blocked 3,095 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 21 0.7% Working exploit published 77 2.5% Proof of concept only 138 4.5% Forecast only 1 0.0% No public exploit 2,859 92.3%

split by StatusSeverityProtectionExploit maturity peak 1,014 / year

1999200220052008201120142017202020232026

3,096 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2026-82390	Low	2026-10-26	Not applicable	No public exploit	The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (default 4) independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode registers, and aes_begin_session() programmed them exactly once, at session start, outside the aes_lock mutex that serialises the transforms. The per-operation handlers aes_ecb_op(), aes_cbc_op() and aes_ctr_op() then ran aes_hal_transform_block() against whatever key and direction the registers happened to hold. As a result, once a second session is opened with a different key, every subsequent operation on the first session silently uses the second session's key and direction, and no error is reported. Because the key programming happened outside the lock, the correct usage pattern of "each thread does begin, then op, then free on its own session" also races: a second thread's cipher_begin_session() landing between the first thread's begin and its operation makes that operation run under the second thread's key. An attacker who can induce session creation on the device — for example a protocol peer whose connection causes a session key to be installed — can influence which key is resident when a victim operation runs. The impact is a cryptographic failure rather than memory corruption: data the application believed it was protecting under one key is encrypted or decrypted under another. Where the resident key is one the attacker knows or supplied, the affected plaintext becomes recoverable by that attacker, and the operation's direction (encrypt versus decrypt) can likewise be inverted. Exposure requires an application that holds two or more concurrent sessions with different keys against this driver; no in-tree Zephyr subsystem does so today (the 802.15.4 security layer, which does open two sessions, uses CCM mode, which this driver rejects), so the risk falls on application code that uses the documented multi-session API. The fix removes all hardware access from aes_begin_session() and reprograms the key and direction at the top of every operation, inside aes_lock, so the chip-global registers can no longer be observed stale by another session.
CVE-2026-116476	Medium	2026-10-26	Not applicable	No public exploit	A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
CVE-2026-116403	Medium	2026-10-26	Not applicable	No public exploit	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
CVE-2026-116263	Low	2026-10-26	Not applicable	Proof of concept only	A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.
CVE-2026-116215	Low	2026-10-26	Not applicable	No public exploit	MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
CVE-2026-116121	Medium	2026-10-26	Not applicable	No public exploit	A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVE-2026-116119	Medium	2026-10-26	Not applicable	No public exploit	A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVE-2026-113915	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
CVE-2026-113900	High	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
CVE-2026-113896	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112708	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.
CVE-2026-112686	Low	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved locking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.
CVE-2026-112669	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-112556	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.
CVE-2026-112543	High	2026-10-26	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.
CVE-2026-112535	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.
CVE-2026-112501	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.
CVE-2026-112492	High	2026-10-26	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
CVE-2026-112477	High	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112459	High	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVE-2026-112442	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.
CVE-2026-112421	Medium	2026-10-26	Not applicable	No public exploit	A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.
CVE-2026-111404	Low	2026-10-26	Not applicable	No public exploit	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
CVE-2026-115567	Medium	2026-10-23	Not applicable	No public exploit	Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.
CVE-2026-114641	Medium	2026-10-22	Not applicable	No public exploit	Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.
CVE-2026-94300	High	2026-10-21	Not applicable	No public exploit	Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-82942	High	2026-10-21	Not applicable	No public exploit	A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact). Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3505
CVE-2026-78118	High	2026-10-21	Not applicable	No public exploit	The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive. When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer. The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data. Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.
CVE-2026-78117	Medium	2026-10-21	Not applicable	No public exploit	The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and populated that descriptor's packetType, dataLength and data fields before acquiring psoc6_bless_operation_sem, so the driver's serialising semaphore protected only the call into Cy_BLE_SoftHciSendAppPkt() and not the shared state that call reads. The Bluetooth host does not guarantee a single HCI sender. Most transmissions are funnelled through the cooperative TX-processor work queue, but bt_hci_cmd_send() deliberately bypasses bt_dev.cmd_tx_queue for BT_HCI_OP_HOST_NUM_COMPLETED_PACKETS and calls bt_send() directly from the caller's thread; that caller is bt_hci_host_num_completed_packets(), the acl_in_pool destroy callback, which runs on whichever thread drops the last reference to a received ACL buffer. CONFIG_BT_HCI_ACL_FLOW_CONTROL defaults to y on this driver's boards, and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() performs that unref from its own preemptible thread. A remote peer that generates Bluetooth traffic concurrently with the device's own transmissions raises the collision rate. When two senders interleave, the semaphore holder can hand the controller a descriptor whose dataLength comes from one net_buf and whose data pointer comes from another — or one whose buffer has already been returned to its pool. The controller then copies and transmits up to a full HCI/ACL payload starting at a shorter or recycled buffer, disclosing adjacent RAM contents to the connected peer; other interleavings duplicate one HCI packet and silently drop another, disrupting the link. The driver only reads through the shared descriptor, so no memory corruption or write primitive results, and the disclosed bytes are not attacker-chosen. The fix makes the descriptor a local variable in psoc6_bless_send(), removing the shared state; Cy_BLE_SoftHciSendAppPkt() copies the packet before returning, so it need not outlive the call.
CVE-2026-113707	Medium	2026-10-21	Not applicable	No public exploit	A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
CVE-2026-86961	High	2026-10-20	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
CVE-2026-86915	Medium	2026-10-20	Not applicable	No public exploit	A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.
CVE-2026-65372	Medium	2026-10-20	Not applicable	No public exploit	A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.
CVE-2026-113311	High	2026-10-20	Not applicable	No public exploit	Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113282	High	2026-10-20	Not applicable	No public exploit	Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113237	Medium	2026-10-20	Not applicable	No public exploit	Race condition in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-113150	High	2026-10-20	Not applicable	No public exploit	Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113059	High	2026-10-20	Not applicable	No public exploit	Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113052	High	2026-10-20	Not applicable	No public exploit	Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113016	High	2026-10-20	Not applicable	No public exploit	Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-112906	Medium	2026-10-20	Not applicable	Proof of concept only	filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.
CVE-2026-101356	Critical	2026-10-20	No exploit published	No public exploit	Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.
CVE-2026-85248	Medium	2026-10-19	No exploit published	No public exploit	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.
CVE-2026-19178	Medium	2026-10-19	Not applicable	No public exploit	IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
CVE-2026-111449	Medium	2026-10-16	Not applicable	No public exploit	Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.
CVE-2026-58100	High	2026-10-15	Not applicable	No public exploit	kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.
CVE-2026-58099	High	2026-10-15	Not applicable	No public exploit	When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
CVE-2026-101311	High	2026-10-15	Not applicable	No public exploit	The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVE-2026-101310	High	2026-10-15	Not applicable	No public exploit	The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVE-2026-101309	High	2026-10-15	Not applicable	No public exploit	The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.
CVE-2026-86562	High	2026-10-14	Not applicable	No public exploit	A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
CVE-2026-100394	Medium	2026-10-14	Not applicable	Proof of concept only	Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.
CVE-2026-97787	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-96949	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-96932	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96919	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96215	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.
CVE-2026-88174	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
CVE-2026-88160	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-88146	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
CVE-2026-88107	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-88096	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.
CVE-2026-87710	High	2026-10-13	Not applicable	No public exploit	Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
CVE-2026-85941	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-85912	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85904	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85825	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-85824	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.
CVE-2026-85357	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85333	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.
CVE-2026-85329	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.
CVE-2026-84014	High	2026-10-13	Not applicable	No public exploit	Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83899	High	2026-10-13	Not applicable	No public exploit	Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-83879	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-83868	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-83841	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-83775	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-83738	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-83722	High	2026-10-13	Not applicable	No public exploit	Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
CVE-2026-83666	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
CVE-2026-82416	High	2026-10-13	Not applicable	No public exploit	FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.
CVE-2026-81971	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-79610	High	2026-10-13	Not applicable	No public exploit	XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.
CVE-2026-71347	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.
CVE-2026-70250	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-70195	Medium	2026-10-13	Not applicable	No public exploit	Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
CVE-2026-70183	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70169	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
CVE-2026-70097	Medium	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.
CVE-2026-69935	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69931	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69856	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69830	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-69766	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69763	High	2026-10-13	Not applicable	No public exploit	Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69736	High	2026-10-13	Not applicable	No public exploit	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-19936	Medium	2026-10-13	Not applicable	No public exploit	The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_msg_manage() runs on the Bluetooth host RX thread, while delayable_msg_handler() runs on the system workqueue. Both block while the lists are in an intermediate state — the enqueuer in bt_rand(), both in bt_mesh_access_send() — which lets the other context observe torn state. delayable_msg_handler() used the result of sys_slist_get() on busy_ctx without a NULL check, and allocate_delayable_msg_ctx() tested sys_slist_is_empty() and then assumed a separate sys_slist_get() would succeed. Because CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG and CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CTX_ENABLED default to y, every model response to a received mesh message is parked on this queue, so the enqueuer runs as a direct consequence of inbound traffic. A peer that can get access-layer messages accepted by a model (it must hold the NetKey and a bound AppKey, so a legitimate or compromised network member) controls the arrival rate, the size of the elicited responses and the destination address, and thereby controls occupancy of the 4-entry context pool and the 40-entry chunk pool. Exhausting the chunk pool forces bt_mesh_delayable_msg_manage() down the purge path, which sends and releases the only queued message and leaves busy_ctx empty while the delayable work item is still armed; if the enqueuer then yields, the handler runs against the empty list. The result is a read-modify-write through a NULL-based pointer (pending_msg->fired_time += 10) at a fixed low address on the system workqueue thread. On typical targets that faults, aborting the system workqueue thread — which stops all workqueue-driven functionality, including the mesh timing machinery — or resetting the node, so the impact is loss of availability of the affected node. The write value and address are fixed and no attacker-controlled length or index is involved, so this is not exploitable for memory corruption or code execution. The same unsynchronized window also allowed one message context to be selected and released by two contexts at once, producing duplicated transmissions, duplicated send-completion callbacks and crossed chunk ownership. The fix serializes every list mutation with a k_spinlock that is never held across a blocking call, makes push_msg_from_delayable_msgs() detach the queue head atomically so a message being sent is on no list, removes the unchecked sys_slist_get() from delayable_msg_handler(), and drops any message that reaches the front of the queue while the stack is suspended or reset.
CVE-2026-109954	High	2026-10-13	Not applicable	No public exploit	Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
CVE-2026-109945	Medium	2026-10-13	Not applicable	Proof of concept only	FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandle, causing client-process heap corruption and termination.
CVE-2026-109779	Medium	2026-10-13	Not applicable	No public exploit	Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2026-82390

Low

2026-10-26

Not applicable

No public exploit

The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (default 4) independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode registers, and aes_begin_session() programmed them exactly once, at session start, outside the aes_lock mutex that serialises the transforms. The per-operation handlers aes_ecb_op(), aes_cbc_op() and aes_ctr_op() then ran aes_hal_transform_block() against whatever key and direction the registers happened to hold. As a result, once a second session is opened with a different key, every subsequent operation on the first session silently uses the second session's key and direction, and no error is reported. Because the key programming happened outside the lock, the correct usage pattern of "each thread does begin, then op, then free on its own session" also races: a second thread's cipher_begin_session() landing between the first thread's begin and its operation makes that operation run under the second thread's key. An attacker who can induce session creation on the device — for example a protocol peer whose connection causes a session key to be installed — can influence which key is resident when a victim operation runs. The impact is a cryptographic failure rather than memory corruption: data the application believed it was protecting under one key is encrypted or decrypted under another. Where the resident key is one the attacker knows or supplied, the affected plaintext becomes recoverable by that attacker, and the operation's direction (encrypt versus decrypt) can likewise be inverted. Exposure requires an application that holds two or more concurrent sessions with different keys against this driver; no in-tree Zephyr subsystem does so today (the 802.15.4 security layer, which does open two sessions, uses CCM mode, which this driver rejects), so the risk falls on application code that uses the documented multi-session API. The fix removes all hardware access from aes_begin_session() and reprograms the key and direction at the top of every operation, inside aes_lock, so the chip-global registers can no longer be observed stale by another session.

CVE-2026-116476

Medium

2026-10-26

Not applicable

No public exploit

A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.

CVE-2026-116403

Medium

2026-10-26

Not applicable

No public exploit

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

CVE-2026-116263

Low

2026-10-26

Not applicable

Proof of concept only

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.

CVE-2026-116215

Low

2026-10-26

Not applicable

No public exploit

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

CVE-2026-116121

Medium

2026-10-26

Not applicable

No public exploit

A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVE-2026-116119

Medium

2026-10-26

Not applicable

No public exploit

A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVE-2026-113915

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.

CVE-2026-113900

High

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.

CVE-2026-113896

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.

CVE-2026-112708

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

CVE-2026-112686

Low

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved locking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.

CVE-2026-112669

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved state handling. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2026-112556

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.

CVE-2026-112543

High

2026-10-26

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.

CVE-2026-112535

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.

CVE-2026-112501

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.

CVE-2026-112492

High

2026-10-26

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.

CVE-2026-112477

High

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-112459

High

2026-10-26

Not applicable

No public exploit

A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.

CVE-2026-112442

Medium

2026-10-26

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.

CVE-2026-112421

Medium

2026-10-26

Not applicable

No public exploit

CVE-2026-111404

Low

2026-10-26

Not applicable

No public exploit

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.

CVE-2026-115567

Medium

2026-10-23

Not applicable

No public exploit

Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.

CVE-2026-114641

Medium

2026-10-22

Not applicable

No public exploit

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.

CVE-2026-94300

High

2026-10-21

Not applicable

No public exploit

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVE-2026-82942

High

2026-10-21

Not applicable

No public exploit

A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact). Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3505

CVE-2026-78118

High

2026-10-21

Not applicable

No public exploit

The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive. When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer. The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data. Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.

CVE-2026-78117

Medium

2026-10-21

Not applicable

No public exploit

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and populated that descriptor's packetType, dataLength and data fields before acquiring psoc6_bless_operation_sem, so the driver's serialising semaphore protected only the call into Cy_BLE_SoftHciSendAppPkt() and not the shared state that call reads. The Bluetooth host does not guarantee a single HCI sender. Most transmissions are funnelled through the cooperative TX-processor work queue, but bt_hci_cmd_send() deliberately bypasses bt_dev.cmd_tx_queue for BT_HCI_OP_HOST_NUM_COMPLETED_PACKETS and calls bt_send() directly from the caller's thread; that caller is bt_hci_host_num_completed_packets(), the acl_in_pool destroy callback, which runs on whichever thread drops the last reference to a received ACL buffer. CONFIG_BT_HCI_ACL_FLOW_CONTROL defaults to y on this driver's boards, and an application that returns -EINPROGRESS from its L2CAP recv callback and later calls bt_l2cap_chan_recv_complete() performs that unref from its own preemptible thread. A remote peer that generates Bluetooth traffic concurrently with the device's own transmissions raises the collision rate. When two senders interleave, the semaphore holder can hand the controller a descriptor whose dataLength comes from one net_buf and whose data pointer comes from another — or one whose buffer has already been returned to its pool. The controller then copies and transmits up to a full HCI/ACL payload starting at a shorter or recycled buffer, disclosing adjacent RAM contents to the connected peer; other interleavings duplicate one HCI packet and silently drop another, disrupting the link. The driver only reads through the shared descriptor, so no memory corruption or write primitive results, and the disclosed bytes are not attacker-chosen. The fix makes the descriptor a local variable in psoc6_bless_send(), removing the shared state; Cy_BLE_SoftHciSendAppPkt() copies the packet before returning, so it need not outlive the call.

CVE-2026-113707

Medium

2026-10-21

Not applicable

No public exploit

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.

CVE-2026-86961

High

2026-10-20

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

CVE-2026-86915

Medium

2026-10-20

Not applicable

No public exploit

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.

CVE-2026-65372

Medium

2026-10-20

Not applicable

No public exploit

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.

CVE-2026-113311

High

2026-10-20

Not applicable

No public exploit

Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113282

High

2026-10-20

Not applicable

No public exploit

Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113237

Medium

2026-10-20

Not applicable

No public exploit

Race condition in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVE-2026-113150

High

2026-10-20

Not applicable

No public exploit

Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113059

High

2026-10-20

Not applicable

No public exploit

Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113052

High

2026-10-20

Not applicable

No public exploit

Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113016

High

2026-10-20

Not applicable

No public exploit

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-112906

Medium

2026-10-20

Not applicable

Proof of concept only

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

CVE-2026-101356

Critical

2026-10-20

No exploit published

No public exploit

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

CVE-2026-85248

Medium

2026-10-19

No exploit published

No public exploit

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.

CVE-2026-19178

Medium

2026-10-19

Not applicable

No public exploit

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

CVE-2026-111449

Medium

2026-10-16

Not applicable

No public exploit

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

CVE-2026-58100

High

2026-10-15

Not applicable

No public exploit

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

CVE-2026-58099

High

2026-10-15

Not applicable

No public exploit

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.

CVE-2026-101311

High

2026-10-15

Not applicable

No public exploit

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVE-2026-101310

High

2026-10-15

Not applicable

No public exploit

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVE-2026-101309

High

2026-10-15

Not applicable

No public exploit

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVE-2026-86562

High

2026-10-14

Not applicable

No public exploit

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

CVE-2026-100394

Medium

2026-10-14

Not applicable

Proof of concept only

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.

CVE-2026-97787

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-96949

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-96932

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.

CVE-2026-96919

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

CVE-2026-96215

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.

CVE-2026-88174

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

CVE-2026-88160

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVE-2026-88146

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

CVE-2026-88107

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-88096

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.

CVE-2026-87710

High

2026-10-13

Not applicable

No public exploit

Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVE-2026-85941

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-85912

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85904

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85825

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

CVE-2026-85824

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.

CVE-2026-85357

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85333

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

CVE-2026-85329

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.

CVE-2026-84014

High

2026-10-13

Not applicable

No public exploit

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

CVE-2026-83899

High

2026-10-13

Not applicable

No public exploit

Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-83879

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

CVE-2026-83868

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-83841

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-83775

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-83738

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-83722

High

2026-10-13

Not applicable

No public exploit

Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVE-2026-83666

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

CVE-2026-82416

High

2026-10-13

Not applicable

No public exploit

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.

CVE-2026-81971

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-79610

High

2026-10-13

Not applicable

No public exploit

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.

CVE-2026-71347

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.

CVE-2026-70250

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-70195

Medium

2026-10-13

Not applicable

No public exploit

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

CVE-2026-70183

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-70169

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

CVE-2026-70097

Medium

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.

CVE-2026-69935

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-69931

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-69856

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-69830

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVE-2026-69766

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-69763

High

2026-10-13

Not applicable

No public exploit

Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.

CVE-2026-69736

High

2026-10-13

Not applicable

No public exploit

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-19936

Medium

2026-10-13

Not applicable

No public exploit

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_msg_manage() runs on the Bluetooth host RX thread, while delayable_msg_handler() runs on the system workqueue. Both block while the lists are in an intermediate state — the enqueuer in bt_rand(), both in bt_mesh_access_send() — which lets the other context observe torn state. delayable_msg_handler() used the result of sys_slist_get() on busy_ctx without a NULL check, and allocate_delayable_msg_ctx() tested sys_slist_is_empty() and then assumed a separate sys_slist_get() would succeed. Because CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG and CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CTX_ENABLED default to y, every model response to a received mesh message is parked on this queue, so the enqueuer runs as a direct consequence of inbound traffic. A peer that can get access-layer messages accepted by a model (it must hold the NetKey and a bound AppKey, so a legitimate or compromised network member) controls the arrival rate, the size of the elicited responses and the destination address, and thereby controls occupancy of the 4-entry context pool and the 40-entry chunk pool. Exhausting the chunk pool forces bt_mesh_delayable_msg_manage() down the purge path, which sends and releases the only queued message and leaves busy_ctx empty while the delayable work item is still armed; if the enqueuer then yields, the handler runs against the empty list. The result is a read-modify-write through a NULL-based pointer (pending_msg->fired_time += 10) at a fixed low address on the system workqueue thread. On typical targets that faults, aborting the system workqueue thread — which stops all workqueue-driven functionality, including the mesh timing machinery — or resetting the node, so the impact is loss of availability of the affected node. The write value and address are fixed and no attacker-controlled length or index is involved, so this is not exploitable for memory corruption or code execution. The same unsynchronized window also allowed one message context to be selected and released by two contexts at once, producing duplicated transmissions, duplicated send-completion callbacks and crossed chunk ownership. The fix serializes every list mutation with a k_spinlock that is never held across a blocking call, makes push_msg_from_delayable_msgs() detach the queue head atomically so a message being sent is on no list, removes the unchecked sys_slist_get() from delayable_msg_handler(), and drops any message that reaches the front of the queue while the stack is suspended or reset.

CVE-2026-109954

High

2026-10-13

Not applicable

No public exploit

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

CVE-2026-109945

Medium

2026-10-13

Not applicable

Proof of concept only

FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandle, causing client-process heap corruption and termination.

CVE-2026-109779

Medium

2026-10-13

Not applicable

No public exploit

Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.