CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (page 6)
Page 6 of 28 — CVEs classified under CWE-362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23440 | High | 7.5 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the dev… |
CVE-2024-40849 | High | 7.5 | 2026-04-02 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox. |
CVE-2026-33544 | High | 7.7 | 2026-04-02 | Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthServic… |
CVE-2026-35099 | High | 7.4 | 2026-04-01 | Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions are 11.2.1.28, 11.3.0… |
CVE-2026-23411 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the refe… |
CVE-2026-23410 | High | 7.8 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race on rawdata dereference There is a race condition that leads to a use-a… |
CVE-2026-34363 | Medium | 5.3 | 2026-03-31 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multip… |
CVE-2026-33028 | High | 7.5 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Condition. Due to the compl… |
CVE-2026-33872 | | 2026-03-27 | elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Informatio… | |
CVE-2026-34368 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains… |
CVE-2026-33009 | High | 8.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an… |
CVE-2026-27814 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_… |
CVE-2026-26074 | High | 7.0 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std::queue>` corruption. The trigger is CS… |
CVE-2026-26072 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optional>` concurrent access (container/option… |
CVE-2026-26071 | Medium | 4.2 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurrent access. with heap-use-after-free pos… |
CVE-2026-26070 | Medium | 4.6 | 2026-03-26 | EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map<std::optional>` concurrent access (container/option… |
CVE-2025-32991 | Critical | 9.0 | 2026-03-25 | In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution. |
CVE-2026-23394 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the rece… |
CVE-2026-23393 | High | 7.8 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, ca… |
CVE-2026-23348 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during runnin… |
CVE-2026-23342 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (… |
CVE-2026-23302 | Medium | 4.7 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other… |
CVE-2026-23294 | High | 7.0 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in devmap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_que… |
CVE-2026-28891 | High | 8.1 | 2026-03-25 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be ab… |
CVE-2026-28888 | Medium | 5.1 | 2026-03-25 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be… |
CVE-2026-28834 | Medium | 5.1 | 2026-03-25 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be… |
CVE-2026-28817 | High | 8.1 | 2026-03-25 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A sandboxed pr… |
CVE-2025-33254 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may l… |
CVE-2025-33238 | High | 7.5 | 2026-03-24 | NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerabil… |
CVE-2026-4684 | High | 7.5 | 2026-03-24 | Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunde… |
CVE-2026-4368 | | 2026-03-23 | Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leadi… | |
CVE-2026-32887 | High | 7.4 | 2026-03-20 | Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when usin… |
CVE-2026-23271 | High | 7.8 | 2026-03-20 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __per… |
CVE-2026-32018 | Low | 3.6 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox contain… |
CVE-2026-32723 | Medium | 4.7 | 2026-03-18 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is… |
CVE-2026-32700 | Medium | 5.3 | 2026-03-18 | Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allows an attacker to c… |
CVE-2026-32398 | Medium | 6.5 | 2026-03-13 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-walle… |
CVE-2026-32242 | High | 7.4 | 2026-03-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's buil… |
CVE-2026-31827 | | 2026-03-10 | Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on… | |
CVE-2026-31824 | High | 8.2 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enf… |
CVE-2026-0121 | Low | 2.9 | 2026-03-10 | In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privilege… |
CVE-2026-0112 | High | 7.4 | 2026-03-10 | In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2026-24297 | Medium | 6.5 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kerberos allows an unauthorized attacker to bypass a sec… |
CVE-2026-24296 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-24295 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker… |
CVE-2026-23671 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized att… |
CVE-2026-23668 | High | 7.0 | 2026-03-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2026-23240 | Critical | 9.8 | 2026-03-10 | In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a cod… |
CVE-2026-23239 | High | 7.8 | 2026-03-10 | In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code… |
CVE-2026-28789 | High | 7.5 | 2026-03-05 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists… |
CVE-2026-28551 | Medium | 4.7 | 2026-03-05 | Race condition vulnerability in the device security management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28549 | Medium | 6.6 | 2026-03-05 | Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28550 | Medium | 4.0 | 2026-03-05 | Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28545 | Medium | 5.9 | 2026-03-05 | Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28544 | Medium | 6.2 | 2026-03-05 | Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28543 | Medium | 4.4 | 2026-03-05 | Race condition vulnerability in the maintenance and diagnostics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-25674 | Low | 3.7 | 2026-03-03 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in D… |
CVE-2025-48641 | High | 7.0 | 2026-03-02 | In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional… |
CVE-2025-48577 | High | 7.4 | 2026-03-02 | In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privi… |
CVE-2025-48568 | High | 7.4 | 2026-03-02 | In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execu… |
CVE-2026-0995 | Low | 3.6 | 2026-03-02 | An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory access… |
CVE-2026-2802 | Medium | 4.2 | 2026-02-24 | Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-27189 | Medium | 6.6 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insu… |
CVE-2026-26201 | High | 7.5 | 2026-02-19 | emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consistent synchronization a… |
CVE-2026-23207 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer check in IRQ handler Now that all other accesses to… |
CVE-2025-71221 | High | 7.8 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Add proper locking in mmp_p… |
CVE-2026-23169 | High | 7.8 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes… |
CVE-2026-23167 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix race between rfkill and nci_unregister_device(). syzbot reported the splat… |
CVE-2026-23161 | High | 7.3 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix race of truncate and swap entry split The helper for shmem swap freei… |
CVE-2026-23153 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transaction is en… |
CVE-2026-23126 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix a race issue related to the operation on bpf_bound_progs list The netdevsi… |
CVE-2026-23118 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix data-race warning and potential load/store tearing Fix the following: … |
CVE-2026-23115 | Medium | 4.7 | 2026-02-14 | In the Linux kernel, the following vulnerability has been resolved: serial: Fix not set tty->port race condition Revert commit bfc467db60b7 ("serial: remove… |
CVE-2026-20677 | Critical | 9.0 | 2026-02-11 | A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS S… |
CVE-2026-20617 | High | 7.0 | 2026-02-11 | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS… |
CVE-2026-2319 | High | 7.5 | 2026-02-11 | Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicio… |
CVE-2025-69871 | High | 8.1 | 2026-02-11 | A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a n… |
CVE-2026-21237 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to ele… |
CVE-2026-21234 | High | 7.0 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized… |
CVE-2026-21231 | High | 7.8 | 2026-02-10 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2025-31944 | Medium | 5.3 | 2026-02-10 | Race condition for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow a denial of service. Authorized adversary with a privileged user c… |
CVE-2025-30513 | High | 7.9 | 2026-02-10 | Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined wi… |
CVE-2026-23684 | Medium | 5.9 | 2026-02-10 | A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being… |
CVE-2026-24930 | High | 8.4 | 2026-02-06 | UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-25536 | High | 7.1 | 2026-02-04 | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data lea… |
CVE-2026-23110 | Medium | 4.7 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The… |
CVE-2026-23071 | Medium | 4.7 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: regmap: Fix race condition in hwspinlock irqsave routine Previously, the address of the s… |
CVE-2026-22548 | Medium | 5.9 | 2026-02-04 | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control c… |
CVE-2026-24040 | Medium | 4.8 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text)… |
CVE-2026-23004 | High | 7.8 | 2026-01-25 | In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to c… |
CVE-2026-22986 | Medium | 4.7 | 2026-01-23 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_… |
CVE-2025-15349 | High | 7.5 | 2026-01-23 | Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on af… |
CVE-2025-66803 | Medium | 4.8 | 2026-01-20 | Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session… |
CVE-2026-23735 | | 2026-01-16 | GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server… | |
CVE-2026-22856 | High | 8.1 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free… |
CVE-2026-22851 | Medium | 5.9 | 2026-01-14 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SD… |
CVE-2025-68969 | Medium | 6.8 | 2026-01-14 | Multi-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68962 | Medium | 5.1 | 2026-01-14 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68961 | Medium | 5.1 | 2026-01-14 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68960 | High | 8.4 | 2026-01-14 | Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability. |