Monthly
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Privilege escalation in FreeBSD's tty subsystem allows a local unprivileged user to gain elevated privileges by exploiting a race condition in the TIOCSCTTY ioctl handler. The handler fails to revalidate terminal state after a lock-drop sequence, enabling a concurrently destroyed terminal to be incorrectly linked to the attacker's session. No public exploit code has been identified at time of analysis, but vendor-confirmed patches exist for all affected release lines (15.0-RELEASE, 15.1-RELEASE, and 14.4-RELEASE).
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Privilege escalation in FreeBSD's tty subsystem allows a local unprivileged user to gain elevated privileges by exploiting a race condition in the TIOCSCTTY ioctl handler. The handler fails to revalidate terminal state after a lock-drop sequence, enabling a concurrently destroyed terminal to be incorrectly linked to the attacker's session. No public exploit code has been identified at time of analysis, but vendor-confirmed patches exist for all affected release lines (15.0-RELEASE, 15.1-RELEASE, and 14.4-RELEASE).
Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.