# Race condition.

Timing between concurrent operations that breaks a check. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts](https://agentprime.io/advisories/CVE-2026-92694.md)
  `CVE-2026-92694` · CVE record: pavel-odintsov fastnetmon · CVSS 5.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition
- [LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding](https://agentprime.io/advisories/CVE-2026-123207.md)
  `CVE-2026-123207` · CVE record: LibreSpark LibreTV · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition
- [Privileged file deletion in SafeNet Authentication Client SACSrv](https://agentprime.io/advisories/CVE-2026-112110.md)
  `CVE-2026-112110` · CVE record: Thalesgroup Safenet Authentication Client Service · CVSS 5.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Race condition
- [Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path](https://agentprime.io/advisories/CVE-2026-103112.md)
  `CVE-2026-103112` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition
- [Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks](https://agentprime.io/advisories/CVE-2026-119345.md)
  `CVE-2026-119345` · CVE record: ultravioletrs cocos · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition
- [Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)](https://agentprime.io/advisories/CVE-2026-123119.md)
  `CVE-2026-123119` · CVE record: sensiolabs symfony · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass](https://agentprime.io/advisories/CVE-2026-122321.md)
  `CVE-2026-122321` · CVE record: kyverno kyverno · CVSS 8.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition
- [APT RCE via hard link reuse](https://agentprime.io/advisories/CVE-2026-109518.md)
  `CVE-2026-109518` · CVE record: Debian APT and 1 more · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition, CWE-62
- [FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close](https://agentprime.io/advisories/CVE-2026-121963.md)
  `CVE-2026-121963` · CVE record: FreeRDP FreeRDP · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition
- [FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race](https://agentprime.io/advisories/CVE-2026-121961.md)
  `CVE-2026-121961` · CVE record: FreeRDP FreeRDP · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition
- [FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race](https://agentprime.io/advisories/CVE-2026-121957.md)
  `CVE-2026-121957` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition
- [Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation](https://agentprime.io/advisories/CVE-2026-100235.md)
  `CVE-2026-100235` · CVE record: Apache Software Foundation Apache ZooKeeper · CVSS 6.0 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition
- [Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode](https://agentprime.io/advisories/CVE-2026-87038.md)
  `CVE-2026-87038` · CVE record: zephyrproject zephyr · CVSS 7.0 High · Not analysed yet · Published 4 Nov 2026 · Tags: Race condition
- [Race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-121230.md)
  `CVE-2026-121230` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [Time-of-check time-of-use race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-121050.md)
  `CVE-2026-121050` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [Time-of-check time-of-use race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-121245.md)
  `CVE-2026-121245` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [Time-of-check time-of-use race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-121048.md)
  `CVE-2026-121048` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [Race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-121079.md)
  `CVE-2026-121079` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace](https://agentprime.io/advisories/CVE-2026-88968.md)
  `CVE-2026-88968` · CVE record: anthropics claude-code · CVSS 7.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal, Race condition
- [Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting](https://agentprime.io/advisories/CVE-2026-121628.md)
  `CVE-2026-121628` · CVE record: bagisto bagisto · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel](https://agentprime.io/advisories/CVE-2026-121408.md)
  `CVE-2026-121408` · CVE record: FreeRDP FreeRDP · CVSS 6.0 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Race condition
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-58926.md)
  `CVE-2026-58926` · CVE record: Google Android · CVSS 2.5 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition, Memory corruption
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59045.md)
  `CVE-2026-59045` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59043.md)
  `CVE-2026-59043` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59042.md)
  `CVE-2026-59042` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59020.md)
  `CVE-2026-59020` · CVE record: Google Android · CVSS 5.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-58857.md)
  `CVE-2026-58857` · CVE record: Google Android · CVSS 8.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition, Memory corruption
- [Race condition in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2026-101182.md)
  `CVE-2026-101182` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution](https://agentprime.io/advisories/CVE-2026-119977.md)
  `CVE-2026-119977` · CVE record: WordPress Foundation WordPress · CVSS 8.1 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 31 Oct 2026 · Tags: Race condition
- [pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check](https://agentprime.io/advisories/CVE-2026-116250.md)
  `CVE-2026-116250` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Race condition
- [pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked](https://agentprime.io/advisories/CVE-2026-116240.md)
  `CVE-2026-116240` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Race condition
- [VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth](https://agentprime.io/advisories/CVE-2026-61854.md)
  `CVE-2026-61854` · CVE record: jackh54 VoiceSentinel · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Race condition, Denial of service, CWE-667
- [charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users](https://agentprime.io/advisories/GHSA-f3fj-9625-rv3m.md)
  `GHSA-f3fj-9625-rv3m`, `GO-2026-6891` · Go `github.com/charmbracelet/soft-serve`: affected `>=0.6.0, <0.12.3`, fixed in `0.12.3` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Race condition
- [epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler](https://agentprime.io/advisories/CVE-2026-115683.md)
  `CVE-2026-115683` · CVE record: GNOME Epiphany · CVSS 6.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Race condition
- [Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler](https://agentprime.io/advisories/CVE-2026-119552.md)
  `CVE-2026-119552` · CVE record: louislam uptime-kuma · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Race condition
- [Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins](https://agentprime.io/advisories/CVE-2026-118030.md)
  `CVE-2026-118030` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Race condition
- [filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock](https://agentprime.io/advisories/GHSA-wfhq-q4j2-c37m.md)
  `GHSA-wfhq-q4j2-c37m`, `CVE-2026-112941` · PyPI `filelock`: affected `>=4.1.0, <4.2.1`, fixed in `4.2.1` · CVSS 3.3 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Race condition
- [filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders](https://agentprime.io/advisories/GHSA-fq56-3cx3-fjxp.md)
  `GHSA-fq56-3cx3-fjxp`, `CVE-2026-112935` · PyPI `filelock`: affected `>=3.22.0, <4.2.1`, fixed in `4.2.1` · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Race condition
- [Race condition in Jenkins](https://agentprime.io/advisories/CVE-2026-117618.md)
  `CVE-2026-117618` · CVE record: Jenkins Project Jenkins · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Race condition
- [Race condition in OpenVPN ovpn-dco-win](https://agentprime.io/advisories/CVE-2026-115402.md)
  `CVE-2026-115402` · CVE record: OpenVPN ovpn-dco-win · CVSS 5.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Race condition, CWE-672
- [Race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-118336.md)
  `CVE-2026-118336` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [Race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-118320.md)
  `CVE-2026-118320` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition](https://agentprime.io/advisories/CVE-2026-118128.md)
  `CVE-2026-118128` · CVE record: a2aproject a2a-js · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL](https://agentprime.io/advisories/GHSA-44jh-23m7-hpcf.md)
  `GHSA-44jh-23m7-hpcf`, `CVE-2026-110861` · npm `better-auth` and 2 more: affected `>=1.6.17, <1.7.7`, fixed in `1.7.7` · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, Race condition
- [Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS](https://agentprime.io/advisories/CVE-2026-92374.md)
  `CVE-2026-92374` · CVE record: TeamViewer Full Client and 1 more · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [a2aproject a2a-java TaskManager.saveTaskEvent race condition](https://agentprime.io/advisories/CVE-2026-117507.md)
  `CVE-2026-117507` · CVE record: a2aproject a2a-java · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [Race condition, use-after-free in the DOM: File component](https://agentprime.io/advisories/CVE-2026-118019.md)
  `CVE-2026-118019` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [Race condition in the IPC component](https://agentprime.io/advisories/CVE-2026-117999.md)
  `CVE-2026-117999` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [Race condition in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-117970.md)
  `CVE-2026-117970` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass](https://agentprime.io/advisories/CVE-2026-117603.md)
  `CVE-2026-117603` · CVE record: spesmilo electrum · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [@fastify/session vulnerable to session revocation bypass via a logout race condition](https://agentprime.io/advisories/CVE-2026-117499.md)
  `CVE-2026-117499` · CVE record: @fastify/session @fastify/session · CVSS 3.7 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition, Authentication bypass
- [Race condition in Apple macOS](https://agentprime.io/advisories/CVE-2026-112708.md)
  `CVE-2026-112708` · CVE record: Apple macOS · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple macOS](https://agentprime.io/advisories/CVE-2026-112421.md)
  `CVE-2026-112421` · CVE record: Apple macOS · CVSS 4.7 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112477.md)
  `CVE-2026-112477` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 7.0 High · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple macOS](https://agentprime.io/advisories/CVE-2026-112535.md)
  `CVE-2026-112535` · CVE record: Apple macOS · CVSS 4.7 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple macOS](https://agentprime.io/advisories/CVE-2026-112543.md)
  `CVE-2026-112543` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple macOS](https://agentprime.io/advisories/CVE-2026-112492.md)
  `CVE-2026-112492` · CVE record: Apple macOS · CVSS 7.0 High · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-113915.md)
  `CVE-2026-113915` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Time-of-check time-of-use race condition in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112576.md)
  `CVE-2026-112576` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition
- [Race condition in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112501.md)
  `CVE-2026-112501` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Race condition

Older: <https://agentprime.io/advisories/tag/race-condition.md?cursor=WyIyMDI2LTEwLTI2VDIwOjM3OjUzLjQ2ODAwMFoiLCJDVkUtMjAyNi0xMTI1MDEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=race-condition>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/race-condition/>. Everything for agents: <https://agentprime.io/llms.txt>.