Advisories · Weakness
Race condition.
Timing between concurrent operations that breaks a check. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.9 Medium
FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts
- pavel-odintsov fastnetmon
- Race condition
- CVSS 2.3 Low
LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding
- LibreSpark LibreTV
- Race condition
- CVSS 5.8 Medium
Privileged file deletion in SafeNet Authentication Client SACSrv
- Thalesgroup Safenet Authentication Client Service
- Path traversal
- Race condition
- CVSS 7.5 High
Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Race condition
- CVSS 7.2 High
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
- ultravioletrs cocos
- Race condition
- CVSS 2.3 Low
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
- sensiolabs symfony
- Race condition
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
- kyverno
- Race condition
- CVSS 7.7 High
APT RCE via hard link reuse
- Debian APT
- Ubuntu APT
- Race condition
- CWE-62
- CVSS 8.2 High
FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close
- FreeRDP
- Race condition
- CVSS 8.2 High
FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
- FreeRDP
- Race condition
- CVSS 8.7 High
FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
- FreeRDP
- Race condition
- CVSS 6.0 Medium
Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
- Apache Software Foundation Apache ZooKeeper
- Race condition
- CVSS 7.0 High
Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode
- zephyr
- Race condition
- CVSS 8.3 High
Race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 8.8 High
Time-of-check time-of-use race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 5.3 Medium
Time-of-check time-of-use race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 8.8 High
Time-of-check time-of-use race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 8.8 High
Race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 7.7 High
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
- anthropics claude-code
- Path traversal
- Race condition
- CVSS 6.3 Medium
Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
- bagisto
- Race condition
- CVSS 6.0 Medium
FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
- FreeRDP
- Race condition
- CVSS 2.5 Low
Use after free in Google Android
- Google Android
- Race condition
- Memory corruption
- CVSS 7.4 High
Race condition in Google Android
- Google Android
- Race condition
- CVSS 7.4 High
Race condition in Google Android
- Google Android
- Race condition
- CVSS 7.4 High
Race condition in Google Android
- Google Android
- Race condition
- CVSS 5.9 Medium
Race condition in Google Android
- Google Android
- Race condition
- CVSS 8.1 High
Use after free in Google Android
- Google Android
- Race condition
- Memory corruption
- CVSS 5.9 Medium
Race condition in Huawei HarmonyOS
- Huawei HarmonyOS
- Race condition
- CVSS 8.1 HighCritical · KEVKEV
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
- WordPress
- Race condition
- CVSS 7.3 High
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
- pgadmin.org pgAdmin 4
- Path traversal
- Race condition
- CVSS 7.1 High
pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
- pgadmin.org pgAdmin 4
- Path traversal
- Race condition
- CVSS 8.2 High
VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
- jackh54 VoiceSentinel
- Race condition
- Denial of service
- CVSS 5.9 Medium
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
- Race condition
>=0.6.0, <0.12.3 · fixed in 0.12.3
GHSA-f3fj-9625-rv3m - CVSS 6.8 Medium
epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
- GNOME Epiphany
- Race condition
- CVSS 6.3 Medium
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
- louislam uptime-kuma
- Race condition
- CVSS 4.2 Medium
Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Race condition
- CVSS 3.3 Low
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
- Race condition
>=4.1.0, <4.2.1 · fixed in 4.2.1
GHSA-wfhq-q4j2-c37m · CVE-2026-112941 - CVSS 4.7 Medium
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
- Race condition
>=3.22.0, <4.2.1 · fixed in 4.2.1
GHSA-fq56-3cx3-fjxp · CVE-2026-112935 - CVSS 8.1 High
Race condition in Jenkins
- Jenkins
- Race condition
- CVSS 5.7 Medium
Race condition in OpenVPN ovpn-dco-win
- OpenVPN ovpn-dco-win
- Race condition
- CWE-672
- CVSS 8.8 High
Race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 8.8 High
Race condition in Google Chrome
- Google Chrome
- Race condition
- CVSS 6.9 Medium
a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
- a2aproject a2a-js
- Race condition
- CVSS 6.3 Medium
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
- Authentication bypass
- Race condition
>=1.6.17, <1.7.7 · fixed in 1.7.7
GHSA-44jh-23m7-hpcf · CVE-2026-110861 - CVSS 7.8 High
Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
- TeamViewer Full Client
- TeamViewer Host
- Race condition
- CVSS 5.3 Medium
a2aproject a2a-java TaskManager.saveTaskEvent race condition
- a2aproject a2a-java
- Race condition
- CVSS 8.8 High
Race condition, use-after-free in the DOM: File component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- CVSS 8.8 High
Race condition in the IPC component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- CVSS 8.8 High
Race condition in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- CVSS 9.3 CriticalCritical · CVSS 9+
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
- spesmilo electrum
- Race condition
- CVSS 3.7 Low
@fastify/session vulnerable to session revocation bypass via a logout race condition
- @fastify/session
- Race condition
- Authentication bypass
- CVSS 5.3 Medium
Race condition in Apple macOS
- Apple macOS
- Race condition
- CVSS 4.7 Medium
Race condition in Apple macOS
- Apple macOS
- Race condition
- CVSS 7.0 High
Race condition in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Race condition
- CVSS 4.7 Medium
Race condition in Apple macOS
- Apple macOS
- Race condition
- CVSS 7.8 High
Race condition in Apple macOS
- Apple macOS
- Race condition
- CVSS 7.0 High
Race condition in Apple macOS
- Apple macOS
- Race condition
- CVSS 4.7 Medium
Race condition in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Race condition
- CVSS 6.5 Medium
Time-of-check time-of-use race condition in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Race condition
- CVSS 6.2 Medium
Race condition in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Race condition