# CWE-366.

Every Advisory and CVE whose sources give the weakness CWE-366, newest first.

## Records, newest first

- [Apache Tomcat Native: Client certificate requirements can be down-graded](https://agentprime.io/advisories/CVE-2026-86247.md)
  `CVE-2026-86247` · CVE record: Apache Software Foundation Apache Tomcat Native · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-366
- [ZCC race condition in ZPA tunnel handler](https://agentprime.io/advisories/CVE-2026-25687.md)
  `CVE-2026-25687` · CVE record: Zscaler Client Connector · CVSS 8.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-366
- [RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()](https://agentprime.io/advisories/CVE-2026-46181.md)
  `CVE-2026-46181` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 28 May 2026 · Tags: CWE-366
- [.NET Framework Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-23666.md)
  `CVE-2026-23666` · CVE record: Microsoft Microsoft .NET Framework 3.5 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-366, CWE-755
- [Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on in…](https://agentprime.io/advisories/CVE-2026-3904.md)
  `CVE-2026-3904` · CVE record: The GNU C Library glibc · CVSS 6.2 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-366
- [Race condition vulnerability in SAP Commerce Cloud](https://agentprime.io/advisories/CVE-2026-23684.md)
  `CVE-2026-23684` · CVE record: SAP_SE SAP Commerce Cloud · CVSS 5.9 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-366
- [Outray has a Race Condition in the cli's webapp](https://agentprime.io/advisories/GHSA-45hj-9x76-wp9g.md)
  `GHSA-45hj-9x76-wp9g`, `CVE-2026-22819` · npm `outray`: affected `<0.1.5`, fixed in `0.1.5` · CVSS 5.9 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-366
- [Mutiple vulnerabilities in the Viridian interface](https://agentprime.io/advisories/CVE-2025-58143.md)
  `CVE-2025-58143` · CVE record: Xen Xen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-366
- [XZ has a heap-use-after-free bug in threaded .xz decoder](https://agentprime.io/advisories/CVE-2025-31115.md)
  `CVE-2025-31115` · CVE record: tukaani-project xz · CVSS 8.7 High · Not analysed yet · Published 3 Apr 2025 · Tags: Memory corruption, CWE-366, CWE-826
- [Ivanti Application Control Engine: A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a…](https://agentprime.io/advisories/CVE-2024-10630.md)
  `CVE-2024-10630` · CVE record: Ivanti Application Control Engine · CVSS 7.8 High · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-366
- [Answer has Race Condition within a Thread in github.com/answerdev/answer](https://agentprime.io/advisories/GHSA-52h8-c876-989c.md)
  `GHSA-52h8-c876-989c`, `CVE-2023-4127`, `GO-2023-1995` · Go `github.com/answerdev/answer`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: CWE-366
- [Race condition in Google Chrome](https://agentprime.io/advisories/CVE-2024-6778.md)
  `CVE-2024-6778` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 16 Jul 2024 · Tags: Race condition, CWE-366
- [A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in paralle...](https://agentprime.io/advisories/GHSA-c546-8jmq-hprj.md)
  `GHSA-c546-8jmq-hprj`, `CVE-2024-2032`, `PYSEC-2024-105` · PyPI `zenml`: affected `<0.55.5`, fixed in `0.55.5` · CVSS 3.1 Low · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-366
- [Kernel: gsm multiplexing race condition leads to privilege escalation](https://agentprime.io/advisories/CVE-2023-6546.md)
  `CVE-2023-6546` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.0 High · Not analysed yet · Published 21 Dec 2023 · Tags: CWE-366
- [Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h](https://agentprime.io/advisories/CVE-2023-4732.md)
  `CVE-2023-4732` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 3 Oct 2023 · Tags: CWE-366
- [Race Condition within a Thread in it-novum/openitcockpit](https://agentprime.io/advisories/CVE-2023-3218.md)
  `CVE-2023-3218` · CVE record: it-novum it-novum/openitcockpit · CVSS 6.5 Medium · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-366
- [Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all](https://agentprime.io/advisories/GHSA-mc8h-8q98-g5hr.md)
  `GHSA-mc8h-8q98-g5hr`, `RUSTSEC-2023-0018` · crates.io `remove_dir_all`: affected `<0.8.0`, fixed in `0.8.0` · No CVSS score · Not analysed yet · Published 24 Feb 2023 · Tags: Race condition, CWE-366
- [oznetmaster SSharpSmartThreadPool SmartThreadPool.cs race condition](https://agentprime.io/advisories/CVE-2015-10067.md)
  `CVE-2015-10067` · CVE record: oznetmaster SSharpSmartThreadPool · CVSS 4.6 Medium · Not analysed yet · Published 18 Jan 2023 · Tags: CWE-366
- [linux kernel: A race condition was found the Linux kernel in perf_event_open() which can be exploited…](https://agentprime.io/advisories/CVE-2022-1729.md)
  `CVE-2022-1729` · CVE record: linux kernel · No CVSS score · Not analysed yet · Published 1 Sept 2022 · Tags: CWE-366
- [Race condition in tokio](https://agentprime.io/advisories/GHSA-2grh-hm3w-w7hv.md)
  `GHSA-2grh-hm3w-w7hv`, `CVE-2021-38191`, `RUSTSEC-2021-0072` · crates.io `tokio`: affected `>=0.3.0, <1.5.1 || >=1.6.0, <1.6.3 || >=1.7.0, <1.7.2 || >=1.8.0, <1.8.1`, fixed in `1.5.1`, `1.6.3`, `1.7.2`, `1.8.1` · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2021 · Tags: Race condition, CWE-366
- [Synology DiskStation Manager (DSM): Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology…](https://agentprime.io/advisories/CVE-2021-26569.md)
  `CVE-2021-26569` · CVE record: Synology Synology DiskStation Manager (DSM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2021 · Tags: CWE-366
- [Junos OS: A race condition vulnerability may cause RPD daemon to crash when processing a BGP NOTIFICATION message.](https://agentprime.io/advisories/CVE-2020-1629.md)
  `CVE-2020-1629` · CVE record: Juniper Networks Junos OS · CVSS 5.9 Medium · Not analysed yet · Published 8 Apr 2020 · Tags: CWE-366

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-366>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-366/>. Everything for agents: <https://agentprime.io/llms.txt>.