CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (page 2)
Page 2 of 28 — CVEs classified under CWE-362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85639 | Medium | 5.6 | 2026-09-04 | A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry End… |
CVE-2026-14367 | Low | 3.1 | 2026-08-31 | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a pla… |
CVE-2026-82543 | High | 7.3 | 2026-08-30 | A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the c… |
CVE-2026-82364 | Medium | 4.2 | 2026-08-29 | A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Su… |
CVE-2026-55784 | High | 7.5 | 2026-08-28 | free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in… |
CVE-2026-77063 | Low | 3.7 | 2026-08-28 | multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a rac… |
CVE-2026-58616 | Medium | 4.4 | 2026-08-28 | Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to d… |
CVE-2026-82258 | Medium | 4.8 | 2026-08-28 | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a sing… |
CVE-2026-59324 | High | 8.2 | 2026-08-27 | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessage… |
CVE-2026-59321 | Medium | 4.2 | 2026-08-27 | A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. th… |
CVE-2026-26456 | High | 7.5 | 2026-08-27 | A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is cau… |
CVE-2025-61480 | High | 7.5 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofe… |
CVE-2026-58093 | High | 7.0 | 2026-08-26 | The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the s… |
CVE-2026-79117 | Medium | 4.3 | 2026-08-25 | Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web or… |
CVE-2026-79094 | Medium | 6.5 | 2026-08-25 | Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chro… |
CVE-2026-79014 | Medium | 4.3 | 2026-08-25 | Race condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin poli… |
CVE-2026-78979 | Medium | 4.3 | 2026-08-25 | Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin polic… |
CVE-2026-78934 | High | 8.3 | 2026-08-25 | Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside th… |
CVE-2026-78915 | High | 7.5 | 2026-08-25 | Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitrary code outside t… |
CVE-2026-78906 | High | 7.5 | 2026-08-25 | Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
CVE-2026-78901 | High | 7.5 | 2026-08-25 | Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-45404 | | 2026-08-24 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized… | |
CVE-2026-77638 | High | 8.9 | 2026-08-20 | Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion servi… |
CVE-2025-62300 | Medium | 5.9 | 2026-08-20 | HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredicta… |
CVE-2026-76393 | Medium | 5.9 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload r… |
CVE-2026-62727 | High | 7.0 | 2026-08-19 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-19506 | High | 8.1 | 2026-08-19 | Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authenticatio… |
CVE-2026-45742 | High | 7.5 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup… |
CVE-2026-58088 | High | 7.4 | 2026-08-19 | The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a se… |
CVE-2026-50139 | Medium | 5.9 | 2026-08-18 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, ser… |
CVE-2026-74984 | Medium | 6.8 | 2026-08-18 | Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-74973 | Medium | 4.2 | 2026-08-18 | Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153… |
CVE-2026-1199 | Low | 3.7 | 2026-08-18 | Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent… |
CVE-2026-64782 | Low | 3.1 | 2026-08-17 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPa… |
CVE-2026-64779 | Low | 3.1 | 2026-08-17 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPa… |
CVE-2026-64865 | | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requ… | |
CVE-2026-19975 | Low | 3.1 | 2026-08-17 | A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.ph… |
CVE-2026-13198 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the eve… | |
CVE-2026-13197 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the con… | |
CVE-2026-73557 | | 2026-08-13 | vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses t… | |
CVE-2026-0295 | High | 7.0 | 2026-08-13 | A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges… |
CVE-2026-7366 | Medium | 4.2 | 2026-08-12 | IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows… |
CVE-2026-18150 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition. |
CVE-2026-18250 | Medium | 6.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race conditi… |
CVE-2026-66802 | High | 8.1 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized a… |
CVE-2026-62908 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate p… |
CVE-2026-62820 | High | 8.1 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over… |
CVE-2026-62780 | High | 7.0 | 2026-08-11 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-62778 | High | 8.1 | 2026-08-11 | Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62748 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-62734 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-62729 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-62705 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bind Filter Driver allows an authorized attacker to elev… |
CVE-2026-62693 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authorized attacker to ele… |
CVE-2026-62690 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-61927 | High | 7.0 | 2026-08-11 | Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-61920 | Medium | 6.6 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a… |
CVE-2026-61352 | High | 7.5 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute… |
CVE-2026-61349 | High | 7.8 | 2026-08-11 | Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-59126 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to e… |
CVE-2026-59122 | High | 7.0 | 2026-08-11 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to eleva… |
CVE-2026-11812 | Low | 2.5 | 2026-08-10 | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the C… |
CVE-2026-71968 | Medium | 6.7 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the abi… |
CVE-2026-9030 | | 2026-08-07 | A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly sy… | |
CVE-2026-70640 | High | 7.0 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1cont… |
CVE-2026-43631 | High | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feat… |
CVE-2026-19139 | High | 7.4 | 2026-08-06 | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a maliciou… |
CVE-2026-48154 | Medium | 5.9 | 2026-08-04 | GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains… |
CVE-2026-47620 | Medium | 6.5 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful expl… |
CVE-2025-15630 | Medium | 5.9 | 2026-08-03 | A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimat… |
CVE-2026-44102 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file… |
CVE-2026-16727 | | 2026-07-30 | Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code… | |
CVE-2026-17999 | Medium | 6.5 | 2026-07-30 | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chro… |
CVE-2026-17993 | High | 7.0 | 2026-07-30 | Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium sec… |
CVE-2026-17979 | High | 7.5 | 2026-07-30 | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu… |
CVE-2026-17855 | Critical | 9.6 | 2026-07-30 | Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
CVE-2026-17841 | Medium | 6.5 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secur… |
CVE-2026-17822 | Medium | 6.5 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secur… |
CVE-2026-17724 | Medium | 4.2 | 2026-07-30 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML p… |
CVE-2026-17712 | High | 8.8 | 2026-07-30 | Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chro… |
CVE-2026-17711 | Critical | 9.6 | 2026-07-30 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-17709 | Critical | 9.6 | 2026-07-30 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-17654 | High | 7.8 | 2026-07-30 | Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromiu… |
CVE-2026-62436 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Gran… |
CVE-2026-62435 | Medium | 6.5 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Gran… |
CVE-2026-62432 | High | 7.3 | 2026-07-28 | The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset… |
CVE-2026-62430 | High | 7.5 | 2026-07-28 | Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of th… |
CVE-2026-62429 | Medium | 6.5 | 2026-07-28 | Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration informa… |
CVE-2026-64720 | Critical | 9.8 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app… |
CVE-2026-43811 | Medium | 4.7 | 2026-07-27 | A race condition was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An app may be able to mod… |
CVE-2026-43805 | Critical | 9.8 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-43781 | Medium | 4.7 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be… |
CVE-2026-43770 | Medium | 4.7 | 2026-07-27 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6. An ap… |
CVE-2026-43755 | High | 7.0 | 2026-07-27 | A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root pr… |
CVE-2026-43728 | High | 7.5 | 2026-07-27 | This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify the state of the Keychai… |
CVE-2026-43693 | High | 7.0 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be… |
CVE-2026-28982 | Critical | 9.8 | 2026-07-27 | A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be… |
CVE-2026-28926 | High | 7.0 | 2026-07-27 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.4. An app may be… |
CVE-2026-10681 | Medium | 6.5 | 2026-07-25 | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _th… |
CVE-2026-64435 | High | 8.2 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers access a… |