CWE-363 · Race Condition Enabling Link Following
15 CVEs classified under CWE-363 (Race Condition Enabling Link Following). Newest first, with CVSS severity, EPSS score and public exploits for each.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62596 | Critical | 10.0 | 2025-11-06 | Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, an… |
CVE-2025-62161 | Critical | 10.0 | 2025-11-06 | Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container e… |
CVE-2024-27102 | Critical | 9.9 | 2024-03-13 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potent… |
CVE-2025-31133 | High | 7.8 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 an… |
CVE-2025-52881 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc… |
CVE-2025-52565 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4… |
CVE-2022-21658 | High | 7.3 | 2022-01-20 | Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG… |
CVE-2026-112940 | High | 7.1 | 2026-10-20 | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX… |
CVE-2025-13492 | High | 7.0 | 2025-12-03 | A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially al… |
CVE-2026-71125 | Medium | 6.1 | 2026-08-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploi… |
CVE-2026-91205 | Medium | 6.0 | 2026-09-18 | A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a… |
CVE-2026-91203 | Medium | 6.0 | 2026-09-18 | A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged f… |
CVE-2026-112914 | Medium | 5.3 | 2026-10-20 | filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowin… |
CVE-2018-6693 | Medium | 5.3 | 2018-09-18 | An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of… |
CVE-2024-45310 | Low | 3.6 | 2024-09-03 | runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tr… |
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-112940 | High | 7.1 | 2026-10-20 | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX… |
CVE-2026-112914 | Medium | 5.3 | 2026-10-20 | filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowin… |
CVE-2026-91205 | Medium | 6.0 | 2026-09-18 | A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a… |
CVE-2026-91203 | Medium | 6.0 | 2026-09-18 | A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged f… |
CVE-2026-71125 | Medium | 6.1 | 2026-08-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploi… |
CVE-2025-13492 | High | 7.0 | 2025-12-03 | A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially al… |
CVE-2025-52881 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc… |
CVE-2025-52565 | High | 7.5 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4… |
CVE-2025-31133 | High | 7.8 | 2025-11-06 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 an… |
CVE-2025-62596 | Critical | 10.0 | 2025-11-06 | Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, an… |
CVE-2025-62161 | Critical | 10.0 | 2025-11-06 | Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container e… |
CVE-2024-45310 | Low | 3.6 | 2024-09-03 | runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tr… |
CVE-2024-27102 | Critical | 9.9 | 2024-03-13 | Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potent… |
CVE-2022-21658 | High | 7.3 | 2022-01-20 | Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG… |
CVE-2018-6693 | Medium | 5.3 | 2018-09-18 | An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of… |