CWE-362
CVEs classified under CWE-362, newest first.
638 CVEsRSS
CVE-2026-69931High· 7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69856High· 7.0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69830High· 8.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-69766High· 7.0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69763High· 7.0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-69736High· 7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-103568High· 7.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
CVE-2026-102211High· 7.0Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVE-2026-102207High· 7.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-82416High· 7.7FrankenPHP is a modern application server for PHP
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION …
CVE-2026-109954Medium· 6.5Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL o…
CVE-2026-109945Medium· 5.3PoCFreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs t…
CVE-2026-109779Medium· 4.2Race condition in the Networking: DNS component
Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-109776Medium· 4.2Race condition in the XPCOM component
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109765Medium· 4.2Race condition, use-after-free in the Graphics: Text component
Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109757High· 8.3Sandbox escape due to race condition in the Networking component
Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109719Medium· 4.2⚖ disputedRace condition, use-after-free in the Graphics: CanvasWebGL component
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
CVE-2026-109407Low· 3.1PoCA security vulnerability has been detected in macrozheng mall up to 1.0.3
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads t…
CVE-2026-19936Medium· 4.8The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronizat…
The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronizat…
CVE-2026-42689Low· 3.7Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.
CVE-2026-109279Low· 2.5ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer…
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer…
CVE-2026-93694Medium· 4.0In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyServi…
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyServi…
CVE-2026-108830Medium· 4.2PoCA weakness has been identified in meetecho janus-gateway up to 1.4.2
A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the …
CVE-2026-97791High· 7.5In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's r…
CVE-2026-100227High· 7.5Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure …
CVE-2026-19571Medium· 6.7The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only af…
The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only af…
CVE-2026-97032High· 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a …
CVE-2026-84230High· 7.5IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
CVE-2026-84271High· 7.8IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.
CVE-2026-42698Medium· 5.3Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.