WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-362✕
Overview 3,094 matches · 40 in Waratek scope · 1 protected · 21 exploited · 12 CISA KEV · 113 public PoC · 7 EPSS ≥ 0.5
3,094matches 40in Waratek scope1.3% 1protected0.0% 21exploited0.7% 12CISA KEV0.4% 113public PoC3.7% 7EPSS ≥ 0.50.2%
Protected by Waratek 1 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 39 1.3% Outside Waratek scope 28 0.9% Not applicable 3,026 97.8% Withdrawn CVE 0 0.0%
Critical 83 2.7% High 1,653 53.4% Medium 1,217 39.3% Low 139 4.5% None 0 0.0% Unknown 2 0.1%
blocked by ARMR today 1 0.0% partly blocked 0 0.0% not blocked 3,093 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 21 0.7% Working exploit published 77 2.5% Proof of concept only 138 4.5% Forecast only 1 0.0% No public exploit 2,857 92.3%
split by peak 1,012 / year
Not applicable: 3,026Outside Waratek scope: 28No exploit published: 39Protected by Waratek: 1 Unknown: 2Low: 139Medium: 1,217High: 1,653Critical: 83 not blocked: 3,093blocked by ARMR today: 1 No public exploit: 2,857Forecast only: 1Proof of concept only: 138Working exploit published: 77Exploited: 21
19991 Not applicable1 Low1 not blocked1 No public exploit1 20001 Not applicable1 Medium1 not blocked1 Working exploit published1 20010 20022 Not applicable2 High1 Low1 not blocked2 No public exploit2 20032 No exploit published1 Not applicable1 High1 Medium1 not blocked2 No public exploit2 20044 Not applicable4 Medium3 Low1 not blocked4 Working exploit published3 No public exploit1 20051 Not applicable1 Medium1 not blocked1 No public exploit1 20066 Not applicable6 Medium5 Low1 not blocked6 Working exploit published2 No public exploit4 200717 Not applicable17 High4 Medium13 not blocked17 No public exploit17 200824 Not applicable24 High5 Medium18 Low1 not blocked24 Working exploit published3 No public exploit21 200933 No exploit published1 Not applicable32 High8 Medium21 Low4 not blocked33 Exploited1 Working exploit published5 No public exploit27 201032 Not applicable32 High7 Medium21 Low4 not blocked32 Working exploit published4 No public exploit28 201117 Not applicable17 High2 Medium13 Low2 not blocked17 Working exploit published1 No public exploit16 201269 No exploit published1 Not applicable68 High10 Medium50 Low9 not blocked69 Working exploit published4 No public exploit65 201364 Not applicable64 High14 Medium45 Low5 not blocked64 Working exploit published1 No public exploit63 201442 Outside Waratek scope2 Not applicable40 High12 Medium25 Low5 not blocked42 Exploited1 Working exploit published2 No public exploit39 201548 No exploit published2 Not applicable46 High12 Medium31 Low5 not blocked48 Working exploit published3 No public exploit45 201646 Outside Waratek scope1 Not applicable45 Critical1 High20 Medium24 Low1 not blocked46 Exploited1 Working exploit published6 Proof of concept only1 No public exploit38 2017113 No exploit published2 Not applicable111 Critical2 High84 Medium26 Low1 not blocked113 Exploited1 Working exploit published19 Proof of concept only1 No public exploit92 2018114 No exploit published5 Outside Waratek scope2 Not applicable107 Critical1 High76 Medium35 Low2 not blocked114 Working exploit published12 Proof of concept only4 No public exploit98 2019102 No exploit published1 Outside Waratek scope7 Not applicable94 Critical2 High64 Medium33 Low3 not blocked102 Exploited3 Working exploit published4 Proof of concept only1 No public exploit94 2020155 No exploit published1 Outside Waratek scope9 Not applicable145 Critical2 High77 Medium71 Low5 not blocked155 Exploited3 Working exploit published3 Proof of concept only1 No public exploit148 2021164 No exploit published3 Outside Waratek scope4 Not applicable157 Critical4 High99 Medium55 Low6 not blocked164 Exploited4 Working exploit published1 Proof of concept only2 No public exploit157 2022236 No exploit published2 Outside Waratek scope3 Not applicable231 Critical3 High128 Medium98 Low7 not blocked236 Exploited3 Working exploit published1 Proof of concept only17 No public exploit215 2023162 No exploit published1 Not applicable161 Critical4 High74 Medium77 Low7 not blocked162 Exploited1 Proof of concept only14 Forecast only1 No public exploit146 2024274 No exploit published3 Not applicable271 Critical9 High157 Medium102 Low6 not blocked274 Exploited1 Working exploit published1 Proof of concept only15 No public exploit257 2025353 No exploit published3 Not applicable350 Critical17 High173 Medium150 Low13 not blocked353 Exploited2 Working exploit published1 Proof of concept only11 No public exploit339 20261,012 Protected by Waratek1 No exploit published13 Not applicable998 Critical38 High625 Medium298 Low49 Unknown2 blocked by ARMR today1 not blocked1,011 Proof of concept only71 No public exploit941
1999200220052008201120142017202020232026
3,094 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 31 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-128069 Medium 2026-11-13 Not applicable No public exploit rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without synchronization. In a multithreaded process, concurrent sanitize calls using different tags: or attributes: options can interleave and cause one call to use the other call's allowlist. If a permissive call admits a script element or event-handler attribute, output expected to be sanitized under a stricter policy can retain it and cause cross-site scripting when rendered. Applications that are single-threaded, use one identical allowlist everywhere, or provide a separate scrubber: are not affected. This issue is fixed in version 1.7.2.
CVE-2026-128042 Medium 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.
CVE-2026-126287 Medium 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitimate client to obtain their own access and refresh tokens, retaining scoped access without triggering reuse detection.
CVE-2026-126280 Critical 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.
CVE-2026-126278 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out.
CVE-2026-125801 Medium 2026-11-13 Not applicable No public exploit Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.
CVE-2026-68511 Medium 2026-11-11 Not applicable Proof of concept only Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
CVE-2026-119618 Unknown 2026-11-11 Not applicable Proof of concept only Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
CVE-2026-112201 Medium 2026-11-11 No exploit published No public exploit A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue specifically affects deployments using MySQL or MariaDB databases in a multi-node configuration. When multiple failed login attempts occur simultaneously for the same account, a synchronization error can cause the system to enter a repetitive loop that locks the user's record in the database. This results in legitimate login attempts for that user being blocked and failing with an error. Furthermore, because some failures are not correctly recorded during this loop, the system's brute-force protection may not accurately count all failed attempts.
CVE-2026-106137 High 2026-11-11 Not applicable No public exploit In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`.
CVE-2026-96171 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96158 High 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96088 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
CVE-2026-96075 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally.
CVE-2026-96048 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
CVE-2026-96019 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-96007 High 2026-11-10 Not applicable No public exploit Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-95989 High 2026-11-10 Not applicable No public exploit Use after free in vhdmp.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-95976 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
CVE-2026-95964 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-95906 High 2026-11-10 Not applicable No public exploit Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-95871 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-95399 Medium 2026-11-10 Not applicable No public exploit In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-94529 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-94519 High 2026-11-10 Not applicable No public exploit Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-94514 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-88237 High 2026-11-10 Not applicable No public exploit Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVE-2026-88228 High 2026-11-10 Not applicable No public exploit Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
CVE-2026-85862 High 2026-11-10 Not applicable No public exploit Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-58778 Medium 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56949 Medium 2026-11-10 Not applicable No public exploit In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55297 Medium 2026-11-10 Not applicable No public exploit In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-125325 Medium 2026-11-10 Not applicable No public exploit pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its clear, refill, and search operations separately. This allows one request to search a corpus populated through another request's search filter, which can return documents belonging to a different tenant or customer without malformed input. The affected responses cannot be identified retrospectively from the server logs. This issue is fixed in version 2.0.0.
CVE-2026-122172 High 2026-11-10 Not applicable No public exploit Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
CVE-2026-122170 High 2026-11-10 Not applicable No public exploit Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-121670 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-120817 High 2026-11-10 Not applicable No public exploit A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.
CVE-2026-119961 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
CVE-2026-119893 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVE-2026-119868 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-119865 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-119385 Medium 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to deny service locally.
CVE-2026-118138 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
CVE-2026-118125 High 2026-11-10 Not applicable No public exploit Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
CVE-2026-118123 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.
CVE-2026-114157 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
CVE-2026-113825 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allows an authorized attacker to execute code over a network.
CVE-2026-113761 High 2026-11-10 Not applicable No public exploit Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-113751 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-112986 High 2026-11-10 Not applicable No public exploit No cwe for this issue in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2026-112976 High 2026-11-10 Not applicable No public exploit Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVE-2026-112813 Medium 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
CVE-2026-112793 High 2026-11-10 Not applicable No public exploit Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-112789 Medium 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to disclose information locally.
CVE-2026-105566 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-105546 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2026-105545 High 2026-11-10 Not applicable No public exploit An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.
CVE-2026-105511 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.
CVE-2026-105509 High 2026-11-10 Not applicable No public exploit Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-105017 High 2026-11-10 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Volume Shadow Copy allows an authorized attacker to elevate privileges locally.
CVE-2025-52537 Medium 2026-11-10 Not applicable No public exploit Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity.
CVE-2026-124622 Medium 2026-11-09 Not applicable No public exploit A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."
CVE-2026-123804 Medium 2026-11-09 Not applicable No public exploit SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
CVE-2026-123128 Low 2026-11-09 Not applicable No public exploit The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
CVE-2026-17337 High 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.
CVE-2026-92694 Medium 2026-11-05 Not applicable No public exploit FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review.
CVE-2026-88814 Low 2026-11-05 Not applicable No public exploit The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
CVE-2026-111770 High 2026-11-05 Not applicable No public exploit The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK clients start request identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than one client and an application that constructs the server or transport once at startup instead of once per request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes reused instances to fail and therefore requires an application code change. This issue is fixed in @modelcontextprotocol/server 2.3.0.
CVE-2026-103112 High 2026-11-05 No exploit published No public exploit A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
CVE-2026-121963 High 2026-11-04 Not applicable Proof of concept only FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.
CVE-2026-121961 High 2026-11-04 Not applicable Proof of concept only FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.
CVE-2026-121957 High 2026-11-04 Not applicable Proof of concept only FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.
CVE-2026-95772 Medium 2026-11-03 Not applicable No public exploit A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.
CVE-2026-121628 Medium 2026-11-03 Not applicable Proof of concept only Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
CVE-2026-121408 Medium 2026-11-03 Not applicable No public exploit FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.
CVE-2026-121230 High 2026-11-03 Not applicable No public exploit Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121079 High 2026-11-03 Not applicable No public exploit Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-59045 High 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59043 High 2026-11-02 Not applicable No public exploit In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59042 High 2026-11-02 Not applicable No public exploit In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59020 Medium 2026-11-02 Not applicable No public exploit In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58927 Medium 2026-11-02 Not applicable No public exploit The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a torn `weak_ptr` state, leading to a virtual call through a freed object's vtable at `cameraObj->getCameraInfo(&desc)`. This allows for potential arbitrary code execution within the `hal_evs_default` process.
CVE-2026-58926 Low 2026-11-02 Not applicable No public exploit A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacker to manipulate freed heap memory, potentially leading to the leakage of file descriptors from the EVS HAL process.
CVE-2026-58857 High 2026-11-02 Not applicable No public exploit In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-101182 Medium 2026-11-02 Not applicable No public exploit Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-61854 High 2026-10-30 Not applicable No public exploit VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
CVE-2026-118030 Medium 2026-10-29 No exploit published No public exploit A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
CVE-2026-117618 High 2026-10-28 No exploit published No public exploit In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.
CVE-2026-115402 Medium 2026-10-28 Not applicable No public exploit OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
CVE-2026-118336 High 2026-10-27 Not applicable No public exploit Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118320 High 2026-10-27 Not applicable No public exploit Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118128 Medium 2026-10-27 Not applicable No public exploit A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
CVE-2026-118019 High 2026-10-27 Not applicable No public exploit Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7.
CVE-2026-117999 High 2026-10-27 Not applicable No public exploit Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117970 High 2026-10-27 Not applicable No public exploit Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117507 Medium 2026-10-27 Not applicable No public exploit A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
CVE-2026-117499 Low 2026-10-27 Not applicable No public exploit @fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.
CVE-2026-84634 Medium 2026-10-26 Not applicable No public exploit A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2026-82390 Low 2026-10-26 Not applicable No public exploit The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (default 4) independent sessions, each carrying its own key and direction. The AES peripheral, however, has a single chip-global set of key and mode registers, and aes_begin_session() programmed them exactly once, at session start, outside the aes_lock mutex that serialises the transforms. The per-operation handlers aes_ecb_op(), aes_cbc_op() and aes_ctr_op() then ran aes_hal_transform_block() against whatever key and direction the registers happened to hold. As a result, once a second session is opened with a different key, every subsequent operation on the first session silently uses the second session's key and direction, and no error is reported. Because the key programming happened outside the lock, the correct usage pattern of "each thread does begin, then op, then free on its own session" also races: a second thread's cipher_begin_session() landing between the first thread's begin and its operation makes that operation run under the second thread's key. An attacker who can induce session creation on the device — for example a protocol peer whose connection causes a session key to be installed — can influence which key is resident when a victim operation runs. The impact is a cryptographic failure rather than memory corruption: data the application believed it was protecting under one key is encrypted or decrypted under another. Where the resident key is one the attacker knows or supplied, the affected plaintext becomes recoverable by that attacker, and the operation's direction (encrypt versus decrypt) can likewise be inverted. Exposure requires an application that holds two or more concurrent sessions with different keys against this driver; no in-tree Zephyr subsystem does so today (the 802.15.4 security layer, which does open two sessions, uses CCM mode, which this driver rejects), so the risk falls on application code that uses the documented multi-session API. The fix removes all hardware access from aes_begin_session() and reprograms the key and direction at the top of every operation, inside aes_lock, so the chip-global registers can no longer be observed stale by another session.
CVE-2026-116476 Medium 2026-10-26 Not applicable No public exploit A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
‹ prev page 1 of 31 next ›