CVE-2026-19975 | Low | 3.1 | 2026-08-17 | A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.ph… |
CVE-2026-13198 | | | 2026-08-14 | Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the eve… |
CVE-2026-13197 | | | 2026-08-14 | Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the con… |
CVE-2026-73557 | | | 2026-08-13 | vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses t… |
CVE-2026-0295 | | | 2026-08-13 | A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges… |
CVE-2026-7366 | Medium | 4.2 | 2026-08-12 | IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows… |
CVE-2026-18150 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition. |
CVE-2026-18250 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race conditi… |
CVE-2026-66802 | High | 8.1 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Azure Attestation service and Device Health Attestatio… |
CVE-2026-62908 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate p… |
CVE-2026-62820 | High | 8.1 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over… |
CVE-2026-62780 | High | 7.0 | 2026-08-11 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-62778 | High | 8.1 | 2026-08-11 | Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62748 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-62734 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-62729 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-62705 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bind Filter Driver allows an authorized attacker to elev… |
CVE-2026-62693 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authorized attacker to ele… |
CVE-2026-62690 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-61927 | High | 7.0 | 2026-08-11 | Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-61920 | Medium | 6.6 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a… |
CVE-2026-61352 | High | 7.5 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute… |
CVE-2026-61349 | High | 7.8 | 2026-08-11 | Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-59126 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to e… |
CVE-2026-59122 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-11812 | Low | 2.5 | 2026-08-10 | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the C… |
CVE-2026-71968 | Medium | 6.7 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the abi… |
CVE-2026-9030 | | | 2026-08-07 | A denial-of-service
vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool
instruction handlng path in httpd does not properly sy… |
CVE-2026-70640 | High | 7.0 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1cont… |
CVE-2026-43631 | High | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feat… |
CVE-2026-19139 | High | 7.4 | 2026-08-06 | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a maliciou… |
CVE-2026-48154 | Medium | 5.9 | 2026-08-04 | GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains… |
CVE-2026-47620 | Medium | 6.5 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful expl… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race
condition exists in the cloud-based Omada device adoption process when an
attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2026-44102 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file… |
CVE-2026-16727 | | | 2026-07-30 | Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code… |
CVE-2026-17999 | Medium | 6.5 | 2026-07-30 | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chro… |
CVE-2026-17993 | High | 7.0 | 2026-07-30 | Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium sec… |
CVE-2026-17979 | High | 7.5 | 2026-07-30 | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu… |
CVE-2026-17855 | Critical | 9.6 | 2026-07-30 | Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-17841 | Medium | 6.5 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secur… |
CVE-2026-17822 | Medium | 6.5 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secur… |
CVE-2026-17724 | Medium | 4.2 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML p… |
CVE-2026-17712 | High | 8.8 | 2026-07-30 | Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chro… |
CVE-2026-17711 | Critical | 9.6 | 2026-07-30 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-17709 | Critical | 9.6 | 2026-07-30 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-17654 | High | 7.8 | 2026-07-30 | Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromiu… |
CVE-2026-62436 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Gran… |
CVE-2026-62435 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Gran… |
CVE-2026-62432 | High | 7.3 | 2026-07-28 | The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset… |
CVE-2026-62430 | High | 7.5 | 2026-07-28 | Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of th… |
CVE-2026-62429 | Medium | 6.5 | 2026-07-28 | Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started. The cleaning up of that
configuration informa… |
CVE-2026-64720 | Critical | 9.8 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app… |
CVE-2026-43811 | Medium | 4.7 | 2026-07-27 | A race condition was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to modify protected parts of the file… |
CVE-2026-43805 | Critical | 9.8 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-43781 | Medium | 4.7 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be… |
CVE-2026-43770 | Medium | 4.7 | 2026-07-27 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. An ap… |
CVE-2026-43755 | High | 7.0 | 2026-07-27 | A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root pr… |
CVE-2026-43728 | High | 7.5 | 2026-07-27 | This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify the state of the Keychai… |
CVE-2026-43693 | High | 7.0 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be… |
CVE-2026-28982 | Critical | 9.8 | 2026-07-27 | A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be… |
CVE-2026-28926 | High | 7.0 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to elevate pr… |
CVE-2026-10681 | Medium | 6.5 | 2026-07-25 | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _th… |
CVE-2026-64282 | Medium | 4.7 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
In the case that… |
CVE-2026-64279 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix adapter deregistration race
Adapters can be looked up by their id using i2… |
CVE-2026-64260 | High | 7.8 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: Avoid queue->stopped races and set/read that value under lock
There are sever… |
CVE-2026-61079 | Medium | 5.8 | 2026-07-21 | Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.2. Diffic… |
CVE-2026-60161 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploi… |
CVE-2026-55219 | Medium | 5.3 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.5, the credit payment implementation in app/L… |
CVE-2026-64189 | High | 7.8 | 2026-07-20 | In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix race between dump and ip_set_list resize
The release path of ip_set… |
CVE-2026-45712 | Medium | 5.9 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets m… |
CVE-2026-63756 | High | 8.1 | 2026-07-20 | SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit au… |
CVE-2026-53400 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved:
i2c: core: fix adapter registration race
Adapters can be looked up based on their id usin… |
CVE-2026-16212 | Medium | 4.2 | 2026-07-19 | A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchas… |
CVE-2026-16211 | Low | 2.6 | 2026-07-19 | A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the… |
CVE-2026-16208 | Medium | 5.0 | 2026-07-19 | A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. Thi… |
CVE-2026-16082 | Medium | 5.3 | 2026-07-18 | A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute… |
CVE-2026-54497 | Medium | 6.8 | 2026-07-17 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base… |
CVE-2026-15995 | Medium | 5.4 | 2026-07-17 | IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain incorrect report summary results or cause… |
CVE-2026-51082 | High | 7.2 | 2026-07-17 | A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-… |
CVE-2026-58598 | High | 7.0 | 2026-07-16 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate p… |
CVE-2026-53518 | High | 8.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint… |
CVE-2026-53517 | High | 8.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token e… |
CVE-2026-62294 | | | 2026-07-15 | Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and follo… |
CVE-2026-58628 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to ele… |
CVE-2026-58543 | Medium | 6.3 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-58531 | High | 7.5 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges… |
CVE-2026-58527 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privile… |
CVE-2026-56649 | Medium | 5.9 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to e… |
CVE-2026-56188 | Critical | 9.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to… |
CVE-2026-54125 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privile… |
CVE-2026-50689 | High | 7.8 | 2026-07-14 | Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-50677 | High | 7.8 | 2026-07-14 | Use after free in Windows Media allows an authorized attacker to elevate privileges locally. |
CVE-2026-50676 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privilege… |
CVE-2026-50672 | High | 7.0 | 2026-07-14 | Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-50669 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-50667 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges… |
CVE-2026-50503 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privile… |
CVE-2026-50460 | High | 8.1 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privi… |
CVE-2026-50458 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |