Overview 1,655 matches · 18 in Waratek scope · 1 protected · 15 exploited · 8 CISA KEV · 79 public PoC · 4 EPSS ≥ 0.5
1,655matches
18in Waratek scope1.1%
1protected0.1%
15exploited0.9%
8CISA KEV0.5%
79public PoC4.8%
4EPSS ≥ 0.50.2%
Protected by Waratek
1
0.1%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
17
1.0%
Outside Waratek scope
18
1.1%
Not applicable
1,619
97.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.1%
partly blocked
0
0.0%
not blocked
1,654
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 627 / year
20021
Not applicable1
High1
not blocked1
No public exploit1
20031
Not applicable1
High1
not blocked1
No public exploit1
20040
20050
20060
20074
Not applicable4
High4
not blocked4
No public exploit4
20085
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
20098
No exploit published1
Not applicable7
High8
not blocked8
Exploited1
Working exploit published2
No public exploit5
20107
Not applicable7
High7
not blocked7
Working exploit published2
No public exploit5
20112
Not applicable2
High2
not blocked2
No public exploit2
201210
Not applicable10
High10
not blocked10
No public exploit10
201314
Not applicable14
High14
not blocked14
No public exploit14
201412
Outside Waratek scope1
Not applicable11
High12
not blocked12
No public exploit12
201512
No exploit published1
Not applicable11
High12
not blocked12
Working exploit published1
No public exploit11
201620
Outside Waratek scope1
Not applicable19
High20
not blocked20
Exploited1
Working exploit published5
Proof of concept only1
No public exploit13
201784
No exploit published1
Not applicable83
High84
not blocked84
Working exploit published16
No public exploit68
201876
No exploit published3
Outside Waratek scope1
Not applicable72
High76
not blocked76
Working exploit published10
Proof of concept only3
No public exploit63
201964
Outside Waratek scope6
Not applicable58
High64
not blocked64
Exploited2
Working exploit published4
Proof of concept only1
No public exploit57
202077
Outside Waratek scope4
Not applicable73
High77
not blocked77
Exploited3
Working exploit published3
No public exploit71
202199
No exploit published1
Outside Waratek scope3
Not applicable95
High99
not blocked99
Exploited1
Proof of concept only2
No public exploit96
2022128
Outside Waratek scope2
Not applicable126
High128
not blocked128
Exploited3
Working exploit published1
Proof of concept only11
No public exploit113
202374
Not applicable74
High74
not blocked74
Exploited1
Proof of concept only7
No public exploit66
2024157
No exploit published1
Not applicable156
High157
not blocked157
Exploited1
Working exploit published1
Proof of concept only8
No public exploit147
2025173
No exploit published2
Not applicable171
High173
not blocked173
Exploited2
Working exploit published1
Proof of concept only2
No public exploit168
2026627
Protected by Waratek1
No exploit published7
Not applicable619
High627
blocked by ARMR today1
not blocked626
Proof of concept only28
No public exploit599
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126278 | High | 2026-11-13 | Not applicable | No public exploit | NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out. |
| CVE-2026-119618 | High | 2026-11-11 | Not applicable | Proof of concept only | Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. |
| CVE-2026-106137 | High | 2026-11-11 | Not applicable | No public exploit | In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`. |
| CVE-2026-96171 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96158 | High | 2026-11-10 | Not applicable | No public exploit | Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96088 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96075 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96019 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96007 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95989 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in vhdmp.sys allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95976 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95964 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| CVE-2026-95906 | High | 2026-11-10 | Not applicable | No public exploit | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-95871 | High | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-94529 | High | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-94519 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-94514 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88237 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88228 | High | 2026-11-10 | Not applicable | No public exploit | Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85862 | High | 2026-11-10 | Not applicable | No public exploit | Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
| CVE-2026-56938 | High | 2026-11-10 | Not applicable | No public exploit | In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| CVE-2026-122172 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally. |
| CVE-2026-122170 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| CVE-2026-121670 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| CVE-2026-120817 | High | 2026-11-10 | Not applicable | No public exploit | A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly. |
| CVE-2026-119961 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network. |
| CVE-2026-119893 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119868 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119865 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118138 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118125 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
| CVE-2026-118123 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-114157 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally. |
| CVE-2026-113825 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allows an authorized attacker to execute code over a network. |
| CVE-2026-113761 | High | 2026-11-10 | Not applicable | No public exploit | Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-113751 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112986 | High | 2026-11-10 | Not applicable | No public exploit | No cwe for this issue in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112976 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-112793 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-105566 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105546 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105545 | High | 2026-11-10 | Not applicable | No public exploit | An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. |
| CVE-2026-105511 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105509 | High | 2026-11-10 | Not applicable | No public exploit | Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105017 | High | 2026-11-10 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Volume Shadow Copy allows an authorized attacker to elevate privileges locally. |
| CVE-2026-17337 | High | 2026-11-07 | Not applicable | No public exploit | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication. |
| CVE-2026-111770 | High | 2026-11-05 | Not applicable | No public exploit | The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK clients start request identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than one client and an application that constructs the server or transport once at startup instead of once per request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes reused instances to fail and therefore requires an application code change. This issue is fixed in @modelcontextprotocol/server 2.3.0. |
| CVE-2026-103112 | High | 2026-11-05 | No exploit published | No public exploit | A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password. |
| CVE-2026-121963 | High | 2026-11-04 | Not applicable | Proof of concept only | FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client. |
| CVE-2026-121961 | High | 2026-11-04 | Not applicable | Proof of concept only | FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process. |
| CVE-2026-121957 | High | 2026-11-04 | Not applicable | Proof of concept only | FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers. |
| CVE-2026-121230 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-121079 | High | 2026-11-03 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-59045 | High | 2026-11-02 | Not applicable | No public exploit | In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59043 | High | 2026-11-02 | Not applicable | No public exploit | In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-59042 | High | 2026-11-02 | Not applicable | No public exploit | In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-58857 | High | 2026-11-02 | Not applicable | No public exploit | In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-61854 | High | 2026-10-30 | Not applicable | No public exploit | VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1. |
| CVE-2026-117618 | High | 2026-10-28 | No exploit published | No public exploit | In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced. |
| CVE-2026-118336 | High | 2026-10-27 | Not applicable | No public exploit | Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118320 | High | 2026-10-27 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-118019 | High | 2026-10-27 | Not applicable | No public exploit | Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and Thunderbird 153.7. |
| CVE-2026-117999 | High | 2026-10-27 | Not applicable | No public exploit | Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-117970 | High | 2026-10-27 | Not applicable | No public exploit | Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
| CVE-2026-113900 | High | 2026-10-26 | Not applicable | No public exploit | A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. |
| CVE-2026-112543 | High | 2026-10-26 | Not applicable | No public exploit | A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox. |
| CVE-2026-112492 | High | 2026-10-26 | Not applicable | No public exploit | A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. |
| CVE-2026-112477 | High | 2026-10-26 | Not applicable | No public exploit | A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. |
| CVE-2026-112459 | High | 2026-10-26 | Not applicable | No public exploit | A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory. |
| CVE-2026-94300 | High | 2026-10-21 | Not applicable | No public exploit | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1. |
| CVE-2026-82942 | High | 2026-10-21 | Not applicable | No public exploit | A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact). Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3505 |
| CVE-2026-78118 | High | 2026-10-21 | Not applicable | No public exploit | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive. When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer. The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data. Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region. |
| CVE-2026-86961 | High | 2026-10-20 | Not applicable | No public exploit | A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox. |
| CVE-2026-113311 | High | 2026-10-20 | Not applicable | No public exploit | Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113282 | High | 2026-10-20 | Not applicable | No public exploit | Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113150 | High | 2026-10-20 | Not applicable | No public exploit | Race condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113059 | High | 2026-10-20 | Not applicable | No public exploit | Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113052 | High | 2026-10-20 | Not applicable | No public exploit | Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-113016 | High | 2026-10-20 | Not applicable | No public exploit | Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-58100 | High | 2026-10-15 | Not applicable | No public exploit | kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges. |
| CVE-2026-58099 | High | 2026-10-15 | Not applicable | No public exploit | When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges. |
| CVE-2026-101311 | High | 2026-10-15 | Not applicable | No public exploit | The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox. |
| CVE-2026-101310 | High | 2026-10-15 | Not applicable | No public exploit | The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox. |
| CVE-2026-101309 | High | 2026-10-15 | Not applicable | No public exploit | The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox. |
| CVE-2026-86562 | High | 2026-10-14 | Not applicable | No public exploit | A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler. |
| CVE-2026-97787 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96949 | High | 2026-10-13 | Not applicable | No public exploit | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96932 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96919 | High | 2026-10-13 | Not applicable | No public exploit | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96215 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88174 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88160 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88146 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88107 | High | 2026-10-13 | Not applicable | No public exploit | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88096 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-87710 | High | 2026-10-13 | Not applicable | No public exploit | Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85941 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85912 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85904 | High | 2026-10-13 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85825 | High | 2026-10-13 | Not applicable | No public exploit | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. |