CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (page 4)
Page 4 of 26 — CVEs classified under CWE-362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32164 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
CVE-2026-32163 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
CVE-2026-32160 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-32159 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-32158 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-32153 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2026-32150 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta… |
CVE-2026-32093 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta… |
CVE-2026-32091 | High | 8.4 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker… |
CVE-2026-32090 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authorized attacker to ele… |
CVE-2026-32089 | High | 7.8 | 2026-04-14 | Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally. |
CVE-2026-32088 | Medium | 6.1 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to byp… |
CVE-2026-32086 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized atta… |
CVE-2026-32083 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr… |
CVE-2026-32082 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr… |
CVE-2026-32068 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate pr… |
CVE-2026-27927 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to e… |
CVE-2026-27926 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized atta… |
CVE-2026-27921 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
CVE-2026-27918 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege… |
CVE-2026-27911 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
CVE-2026-26181 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-26174 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to e… |
CVE-2026-26173 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2026-26172 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-26168 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2026-26167 | High | 8.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-25184 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized… |
CVE-2026-20930 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-34862 | Medium | 6.3 | 2026-04-13 | Race condition vulnerability in the power consumption statistics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34861 | Medium | 6.3 | 2026-04-13 | Race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34858 | Medium | 4.1 | 2026-04-13 | UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34857 | Medium | 4.7 | 2026-04-13 | UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34849 | Low | 2.5 | 2026-04-13 | UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34856 | High | 7.3 | 2026-04-13 | UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34851 | Low | 2.2 | 2026-04-13 | Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-34850 | Low | 1.9 | 2026-04-13 | Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-40178 | Medium | 5.9 | 2026-04-10 | ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a shor… |
CVE-2026-5774 | Medium | 6.4 | 2026-04-10 | Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause… |
CVE-2026-5902 | Critical | 9.8 | 2026-04-08 | Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream met… |
CVE-2026-5893 | Medium | 6.8 | 2026-04-08 | Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
CVE-2026-5890 | Medium | 5.3 | 2026-04-08 | Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a craft… |
CVE-2026-39880 | Medium | 5.0 | 2026-04-08 | Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an… |
CVE-2026-35554 | High | 8.7 | 2026-04-07 | A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a pro… |
CVE-2025-54601 | High | 7.0 | 2026-04-06 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2025-54602 | High | 7.0 | 2026-04-06 | An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, 1580, W920, W930… |
CVE-2026-23469 | Medium | 4.7 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Synchronize interrupts before suspending the GPU The runtime PM suspend… |
CVE-2026-23463 | Medium | 4.7 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is… |
CVE-2026-23452 | Medium | 4.7 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runt… |
CVE-2026-23441 | Medium | 4.7 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec off… |
CVE-2026-23440 | High | 7.5 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the dev… |
CVE-2024-40849 | High | 7.5 | 2026-04-02 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox. |
CVE-2026-33544 | High | 7.7 | 2026-04-02 | Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthServic… |
CVE-2026-35099 | High | 7.4 | 2026-04-01 | Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0… |
CVE-2026-23411 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the refe… |
CVE-2026-23410 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-a… |
CVE-2026-34363 | Medium | 5.3 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multip… |
CVE-2026-33028 | High | 7.5 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the compl… |
CVE-2026-33872 | | 2026-03-27 | elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Informatio… | |
CVE-2026-34368 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains… |
CVE-2026-33009 | High | 8.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an… |
CVE-2026-27814 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_… |
CVE-2026-26074 | High | 7.0 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std::queue>` corruption. The trigger is CS… |
CVE-2026-26072 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optional>` concurrent access (container/option… |
CVE-2026-26071 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurrent access. with heap-use-after-free pos… |
CVE-2026-26070 | Medium | 4.6 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optional>` concurrent access (container/option… |
CVE-2025-32991 | Critical | 9.0 | 2026-03-25 | In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution. |
CVE-2026-23394 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the rece… |
CVE-2026-23393 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, ca… |
CVE-2026-23348 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during runnin… |
CVE-2026-23342 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (… |
CVE-2026-23302 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other… |
CVE-2026-23294 | High | 7.0 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in devmap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_que… |
CVE-2026-28891 | High | 8.1 | 2026-03-25 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be ab… |
CVE-2026-28888 | Medium | 5.1 | 2026-03-25 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be… |
CVE-2026-28834 | Medium | 5.1 | 2026-03-25 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be… |
CVE-2026-28817 | High | 8.1 | 2026-03-25 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A sandboxed pr… |
CVE-2025-33254 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may l… |
CVE-2025-33238 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerabil… |
CVE-2026-4684 | High | 7.5 | 2026-03-24 | Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunde… |
CVE-2026-4368 | | 2026-03-23 | Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leadi… | |
CVE-2026-32887 | High | 7.4 | 2026-03-20 | Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when usin… |
CVE-2026-23271 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __per… |
CVE-2026-32018 | Low | 3.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox contain… |
CVE-2026-32723 | Medium | 4.7 | 2026-03-18 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is… |
CVE-2026-32700 | Medium | 5.3 | 2026-03-18 | Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to c… |
CVE-2026-32398 | Medium | 6.5 | 2026-03-13 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-walle… |
CVE-2026-32242 | High | 7.4 | 2026-03-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's buil… |
CVE-2026-31827 | | 2026-03-10 | Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on… | |
CVE-2026-31824 | High | 8.2 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enf… |
CVE-2026-0121 | Low | 2.9 | 2026-03-10 | In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privilege… |
CVE-2026-0112 | High | 7.4 | 2026-03-10 | In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2026-24297 | Medium | 6.5 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a sec… |
CVE-2026-24296 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24295 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-23671 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized att… |
CVE-2026-23668 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2026-23240 | Critical | 9.8 | 2026-03-10 | In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a cod… |
CVE-2026-23239 | High | 7.8 | 2026-03-10 | In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code… |
CVE-2026-28789 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists… |