CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (page 3)
Page 3 of 26 — CVEs classified under CWE-362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11145 | Medium | 5.3 | 2026-06-04 | Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium s… |
CVE-2026-10940 | High | 8.3 | 2026-06-04 | Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-46272 | Medium | 4.7 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode When trying to run per… |
CVE-2026-10565 | Low | 3.1 | 2026-06-02 | A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the co… |
CVE-2026-9831 | Medium | 6.3 | 2026-05-29 | A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermit… |
CVE-2026-47741 | Medium | 5.9 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and increment… |
CVE-2026-9959 | Low | 3.1 | 2026-05-28 | Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-10006 | High | 7.5 | 2026-05-28 | Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromi… |
CVE-2026-46187 | Medium | 4.7 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use b… |
CVE-2026-46157 | High | 7.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss… |
CVE-2026-46137 | Critical | 9.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential data-race This mptcp_pm_add_timer() helper is exec… |
CVE-2026-46135 | Critical | 9.8 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() up… |
CVE-2026-47270 | Medium | 6.3 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo… |
CVE-2026-48066 | Medium | 5.7 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/log.c contains a process-wide static pointer that is wri… |
CVE-2026-45090 | High | 7.5 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, ParameterAnalysis in pkg/scanning/parameterAnalysis.go runs tw… |
CVE-2026-44318 | Medium | 6.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an uns… |
CVE-2026-5516 | Medium | 4.4 | 2026-05-27 | IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security… |
CVE-2026-46058 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m job_abort and device_run Fix kernel panic caused by… |
CVE-2026-46025 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damon_call() vs kdamond_fn() exit race Patch series "mm/damon/core: fi… |
CVE-2026-46017 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: mm: fix deferred split queue races during migration migrate_folio_move() records the defe… |
CVE-2026-46008 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is… |
CVE-2026-45949 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and work_struct to fix race condition Currently, hwrng_fill is not… |
CVE-2026-45945 | High | 8.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table… |
CVE-2026-45942 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed duri… |
CVE-2026-45910 | High | 7.8 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WA… |
CVE-2026-45905 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path icmp_route_lookup() performs m… |
CVE-2025-71303 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix race condition when checking rpm_on When autosuspend is triggered, dri… |
CVE-2025-46284 | High | 7.0 | 2026-05-26 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to gain root privilege… |
CVE-2026-44443 | Medium | 4.8 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not v… |
CVE-2026-24199 | Medium | 4.7 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memo… |
CVE-2026-43981 | | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released be… | |
CVE-2026-46727 | High | 8.1 | 2026-05-22 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo i… |
CVE-2026-4635 | Medium | 6.5 | 2026-05-22 | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notificati… |
CVE-2026-44059 | Medium | 4.5 | 2026-05-21 | A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data… |
CVE-2026-5947 | High | 7.5 | 2026-05-20 | Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it b… |
CVE-2026-42099 | High | 7.5 | 2026-05-19 | Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the ob… |
CVE-2026-23558 | High | 7.8 | 2026-05-19 | The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version ch… |
CVE-2026-32848 | Medium | 4.7 | 2026-05-18 | NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger… |
CVE-2026-8741 | Low | 3.1 | 2026-05-17 | A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component… |
CVE-2026-45675 | High | 8.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP and OAuth authentication flows use… |
CVE-2026-41964 | High | 8.4 | 2026-05-15 | Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-8520 | High | 8.3 | 2026-05-14 | Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium… |
CVE-2026-42594 | High | 7.5 | 2026-05-14 | Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's e… |
CVE-2026-28379 | Medium | 6.5 | 2026-05-13 | A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map ac… |
CVE-2026-0235 | Medium | 4.7 | 2026-05-13 | A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control p… |
CVE-2026-34351 | High | 7.8 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
CVE-2026-34345 | High | 7.0 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-34342 | High | 7.0 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker t… |
CVE-2026-34337 | High | 7.8 | 2026-05-12 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-34334 | High | 7.8 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
CVE-2026-34331 | High | 7.0 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-33839 | High | 7.0 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-32161 | High | 7.5 | 2026-05-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attac… |
CVE-2026-7432 | High | 7.8 | 2026-05-12 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM |
CVE-2026-43930 | Medium | 5.9 | 2026-05-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in… |
CVE-2026-43659 | Medium | 4.7 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28996 | Medium | 5.5 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Ta… |
CVE-2026-28992 | Medium | 4.7 | 2026-05-11 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Seq… |
CVE-2026-28986 | High | 7.5 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28924 | High | 7.5 | 2026-05-11 | A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An… |
CVE-2026-28830 | Medium | 4.7 | 2026-05-11 | A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data. |
CVE-2026-43448 | Medium | 4.7 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix race bug in nvme_poll_irqdisable() In the following scenario, pdev can be d… |
CVE-2026-43439 | Medium | 4.7 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: cgroup: fix race between task migration and iteration When a task is migrated out of a cs… |
CVE-2026-43430 | Medium | 4.7 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: usb: yurex: fix race in probe The bbu member of the descriptor must be set to the value s… |
CVE-2026-43415 | Medium | 4.7 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend In __ufshcd_wl_suspen… |
CVE-2026-43353 | High | 7.8 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue The HCI DMA dequeue path (hci_dma_dequeue… |
CVE-2026-43342 | Medium | 4.7 | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Protect RNDIS options with mutex The class/subclass/protocol option… |
CVE-2026-7960 | Medium | 5.3 | 2026-05-06 | Race in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive infor… |
CVE-2026-7954 | Low | 3.1 | 2026-05-06 | Race in Shared Storage in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via… |
CVE-2026-7948 | High | 7.5 | 2026-05-06 | Race in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium… |
CVE-2026-43275 | Medium | 4.7 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Flush exception handling work when RPM level is zero Ensure that the exc… |
CVE-2026-43198 | Critical | 9.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after th… |
CVE-2026-43163 | Medium | 4.7 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs… |
CVE-2026-43121 | Medium | 4.7 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref… |
CVE-2025-71274 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_s… |
CVE-2026-43116 | High | 7.8 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the exp… |
CVE-2026-7846 | Low | 2.6 | 2026-05-05 | A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/ser… |
CVE-2026-7724 | Medium | 5.0 | 2026-05-04 | A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate_restricted_url of the component… |
CVE-2026-43023 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_connect() checks sk_st… |
CVE-2026-31761 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Move iio_device_register() to correct location iio_device_register()… |
CVE-2026-31751 | Medium | 4.7 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: comedi: dt2815: add hardware detection to prevent crash The dt2815 driver crashes when at… |
CVE-2026-31728 | Medium | 4.7 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop A race condition be… |
CVE-2026-31700 | High | 7.8 | 2026-05-01 | In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In tpacket_snd(), when PA… |
CVE-2026-26206 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API b… |
CVE-2026-7351 | Low | 3.1 | 2026-04-28 | Race in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via… |
CVE-2026-41913 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per… |
CVE-2026-3006 | High | 7.0 | 2026-04-27 | Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege e… |
CVE-2026-31572 | Medium | 4.7 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: i2c: designware: amdisp: Fix resume-probe race condition issue Identified resume-probe ra… |
CVE-2026-6921 | High | 8.3 | 2026-04-23 | Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Ch… |
CVE-2026-31516 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: xfrm: prevent policy_hthresh.work from racing with netns teardown A XFRM_MSG_NEWSPDINFO r… |
CVE-2026-31466 | Medium | 4.7 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64 server, we found f… |
CVE-2026-31456 | Medium | 4.7 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry i… |
CVE-2026-41458 | | 2026-04-22 | OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the s… | |
CVE-2026-40943 | | 2026-04-21 | Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the serv… | |
CVE-2026-40155 | Medium | 5.4 | 2026-04-17 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that… |
CVE-2026-33827 | High | 8.1 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code o… |
CVE-2026-33104 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2026-32226 | Medium | 5.9 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service o… |
CVE-2026-32219 | High | 7.0 | 2026-04-14 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-32165 | High | 7.8 | 2026-04-14 | Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally. |