# Race condition.

Timing between concurrent operations that breaks a check. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Windows DCOM Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88096.md)
  `CVE-2026-88096` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows BitLocker Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85920.md)
  `CVE-2026-85920` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Security Center Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-71347.md)
  `CVE-2026-71347` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Composite Image File System Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85824.md)
  `CVE-2026-85824` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85825.md)
  `CVE-2026-85825` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Phone Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85357.md)
  `CVE-2026-85357` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Performance Monitor Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85333.md)
  `CVE-2026-85333` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Print Spooler Components Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-84018.md)
  `CVE-2026-84018` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Device Association Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-84014.md)
  `CVE-2026-84014` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, Race condition
- [Windows Projected File System Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-84009.md)
  `CVE-2026-84009` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83871.md)
  `CVE-2026-83871` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, Race condition
- [Windows Overlay Filter Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83879.md)
  `CVE-2026-83879` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Microsoft Bluetooth Driver Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83868.md)
  `CVE-2026-83868` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Hyper-V Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83839.md)
  `CVE-2026-83839` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83834.md)
  `CVE-2026-83834` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Installer Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83775.md)
  `CVE-2026-83775` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, Race condition
- [Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83738.md)
  `CVE-2026-83738` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83722.md)
  `CVE-2026-83722` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83666.md)
  `CVE-2026-83666` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Setup Files Cleanup Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83510.md)
  `CVE-2026-83510` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows SmartScreen Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83504.md)
  `CVE-2026-83504` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows DHCP Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69830.md)
  `CVE-2026-69830` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70195.md)
  `CVE-2026-70195` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Connected Devices Platform Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70169.md)
  `CVE-2026-70169` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-70097.md)
  `CVE-2026-70097` · CVE record: Microsoft Windows 11 Version 24H2 and 4 more · CVSS 5.6 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Windows Storage Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69935.md)
  `CVE-2026-69935` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Storage Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69766.md)
  `CVE-2026-69766` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Windows Storage Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69763.md)
  `CVE-2026-69763` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [grant-table: double version change race](https://agentprime.io/advisories/CVE-2026-79610.md)
  `CVE-2026-79610` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference](https://agentprime.io/advisories/CVE-2026-109954.md)
  `CVE-2026-109954` · CVE record: parse-community parse-server · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit](https://agentprime.io/advisories/CVE-2026-109945.md)
  `CVE-2026-109945` · CVE record: FreeRDP FreeRDP · CVSS 6.0 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [macrozheng mall Coupon Redemption generateOrder race condition](https://agentprime.io/advisories/CVE-2026-109407.md)
  `CVE-2026-109407` · CVE record: macrozheng mall · CVSS 2.3 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Race condition in the Networking: DNS component](https://agentprime.io/advisories/CVE-2026-109779.md)
  `CVE-2026-109779` · CVE record: Mozilla Firefox and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Race condition in the XPCOM component](https://agentprime.io/advisories/CVE-2026-109776.md)
  `CVE-2026-109776` · CVE record: Mozilla Firefox and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Race condition, use-after-free in the Graphics: Text component](https://agentprime.io/advisories/CVE-2026-109765.md)
  `CVE-2026-109765` · CVE record: Mozilla Firefox and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Sandbox escape due to race condition in the Networking component](https://agentprime.io/advisories/CVE-2026-109757.md)
  `CVE-2026-109757` · CVE record: Mozilla Firefox and 1 more · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition
- [Race condition, use-after-free in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-109719.md)
  `CVE-2026-109719` · CVE record: Mozilla Firefox and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, Memory corruption
- [Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference](https://agentprime.io/advisories/CVE-2026-19936.md)
  `CVE-2026-19936` · CVE record: zephyrproject zephyr · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Race condition
- [Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks](https://agentprime.io/advisories/CVE-2026-108361.md)
  `CVE-2026-108361` · CVE record: Privasys ra-tls-clients · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Race condition
- [WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability](https://agentprime.io/advisories/CVE-2026-42689.md)
  `CVE-2026-42689` · CVE record: Pixelite Events Manager · CVSS 3.7 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Race condition
- [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access](https://agentprime.io/advisories/CVE-2026-109279.md)
  `CVE-2026-109279` · CVE record: ImageMagick ImageMagick · CVSS 2.0 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Race condition
- [Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller](https://agentprime.io/advisories/CVE-2026-93694.md)
  `CVE-2026-93694` · CVE record: Progress ShareFile Storage Zones Controller · CVSS 4.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Hard-coded credentials, Race condition, Server-side request forgery (SSRF)
- [meetecho janus-gateway VideoRoom janus_videoroom.c race condition](https://agentprime.io/advisories/CVE-2026-108830.md)
  `CVE-2026-108830` · CVE record: meetecho janus-gateway · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Race condition
- [hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition](https://agentprime.io/advisories/CVE-2026-108698.md)
  `CVE-2026-108698` · CVE record: hyper-mcp-rs hyper-mcp · CVSS 8.3 High · Not analysed yet · Published 11 Oct 2026 · Tags: Race condition
- [Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker](https://agentprime.io/advisories/CVE-2026-108741.md)
  `CVE-2026-108741` · CVE record: shepherd-agents Shepherd · CVSS 2.3 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Race condition
- [Apache CXF: XML Signature wrapping in JAX-RS XML Security](https://agentprime.io/advisories/CVE-2026-100227.md)
  `CVE-2026-100227` · CVE record: Apache Software Foundation Apache CXF · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Race condition
- [Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests](https://agentprime.io/advisories/CVE-2026-97791.md)
  `CVE-2026-97791` · CVE record: Apache Software Foundation Apache CXF · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Race condition
- [Apache CXF: JPA authorization-code consume is non-atomic](https://agentprime.io/advisories/CVE-2026-73179.md)
  `CVE-2026-73179` · CVE record: Apache Software Foundation Apache CXF · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Race condition
- [Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer](https://agentprime.io/advisories/CVE-2026-19571.md)
  `CVE-2026-19571` · CVE record: zephyrproject zephyr · CVSS 6.7 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Race condition
- [A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated c…](https://agentprime.io/advisories/CVE-2025-61560.md)
  `CVE-2025-61560` · CVE record · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Race condition
- [HTTP/2 server crash due to HPACK encoder race in net/http](https://agentprime.io/advisories/GO-2026-6617.md)
  `GO-2026-6617`, `BIT-golang-2026-97032`, `CVE-2026-97032` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF](https://agentprime.io/advisories/GHSA-4w49-gwv8-fpjg.md)
  `GHSA-4w49-gwv8-fpjg`, `CVE-2026-60091`, `PYSEC-2026-4249` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Authentication bypass, Race condition, Server-side request forgery (SSRF)
- [IBM Guardium Data Protection is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-84230.md)
  `CVE-2026-84230` · CVE record: IBM Guardium Data Protection · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [IBM Guardium Data Protection Signature Verification Bypass](https://agentprime.io/advisories/CVE-2026-84271.md)
  `CVE-2026-84271` · CVE record: IBM Guardium Data Protection · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [PraisonAI: DNS rebinding bypass in \`web_crawl\` SSRF protection allows internal response disclosure](https://agentprime.io/advisories/GHSA-qg25-6gc4-48mg.md)
  `GHSA-qg25-6gc4-48mg`, `CVE-2026-61430`, `PYSEC-2026-4272` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Race condition, Server-side request forgery (SSRF)
- [WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability](https://agentprime.io/advisories/CVE-2026-42698.md)
  `CVE-2026-42698` · CVE record: Themeum Tutor LMS · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [Race condition in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94584.md)
  `CVE-2026-94584` · CVE record: Brocade Fabric OS · CVSS 2.1 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [Race condition in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94583.md)
  `CVE-2026-94583` · CVE record: Brocade Fabric OS · CVSS 2.1 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU).](https://agentprime.io/advisories/CVE-2026-67693.md)
  `CVE-2026-67693` · CVE record · CVSS 3.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Race condition
- [Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)](https://agentprime.io/advisories/GHSA-pc36-qwjq-x68c.md)
  `GHSA-pc36-qwjq-x68c`, `CVE-2026-105743`, `PYSEC-2026-4190`, `PYSEC-2026-4214` · PyPI `docling` and 1 more: affected `>=2.91.0, <2.132.0`, fixed in `2.132.0` · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Race condition, Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/race-condition.md>
Older: <https://agentprime.io/advisories/tag/race-condition.md?cursor=WyIyMDI2LTEwLTA3VDIwOjQyOjE5LjAwMDAwMFoiLCJHSFNBLXBjMzYtcXdqcS14NjhjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=race-condition&cursor=WyIyMDI2LTEwLTEzVDE5OjAwOjEyLjAwMzAwMFoiLCJDVkUtMjAyNi04ODE2MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/race-condition/?cursor=WyIyMDI2LTEwLTEzVDE5OjAwOjEyLjAwMzAwMFoiLCJDVkUtMjAyNi04ODE2MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.