Monthly
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 can, under a narrow timing window, down-grade the client-certificate verification requirement for connections, weakening mutual-TLS authentication for deployments that enforce client-cert auth through the APR/OpenSSL-based connector. The flaw is a CWE-366 race condition within a thread (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so an unauthenticated network attacker must win a non-deterministic race to succeed, making exploitation probabilistic rather than guaranteed. Only Tomcat instances that actually use Tomcat Native and are configured for client-certificate verification are exposed; no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation. Vendor-released fixes are available in 2.0.16 and 1.3.9.
Heap corruption triggered by a race condition in the Zscaler Client Connector (ZCC) ZPA tunnel handler allows remote, unauthenticated attackers to crash the client process and, under conditions requiring successful heap grooming, potentially execute code in the context of that process. Only ZCC builds below 4.6.0.486, 4.7.0.350, 4.8.0.267 and 4.9.0.412 are affected, and the practical outcome is more reliably a denial-of-service (client crash) than dependable code execution because the underlying race is non-deterministic and hard to win. No public exploit has been identified at time of analysis and the risk is low-immediacy (EPSS ~0.23%, 14th percentile; SSVC Exploitation: none, Automatable: no), despite the vendor's CVSS 8.1 rating.
Local privilege escalation or denial-of-service in the Linux kernel's RDMA/mlx4 InfiniBand driver stems from improper RCU synchronization in mlx4_srq_event(), where the mlx4_srq structure is never freed via RCU and can be accessed before initialization completes. Local low-privileged users on systems using Mellanox ConnectX (mlx4) RDMA hardware can trigger a race condition leading to memory corruption or kernel crash, with CVSS 7.8 reflecting high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS scores this at just 0.02%, indicating minimal real-world exploitation likelihood.
Denial of service in GNU C Library 2.36 on x86_64 systems occurs when nscd-backed functions trigger a race condition in the optimized memcmp implementation, allowing concurrent thread modification of input data to cause application crashes. This affects any application using NSS caching functionality under high load conditions. No patch is currently available.
Commerce Cloud versions up to 2205 contains a vulnerability that allows attackers to a cart entry being created with erroneous product value which could be checked o (CVSS 5.9).
Outray versions prior to 0.1.5 lack database transaction locking in the subdomain creation API endpoint, allowing authenticated users to bypass rate limits and provision more subdomains than permitted by their service tier. Public exploit code exists for this vulnerability, which affects the quota enforcement mechanism for free plan users. Upgrade to version 0.1.5 or later to remediate.
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XZ Utils provide a general-purpose data-compression library plus command-line tools. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 can, under a narrow timing window, down-grade the client-certificate verification requirement for connections, weakening mutual-TLS authentication for deployments that enforce client-cert auth through the APR/OpenSSL-based connector. The flaw is a CWE-366 race condition within a thread (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so an unauthenticated network attacker must win a non-deterministic race to succeed, making exploitation probabilistic rather than guaranteed. Only Tomcat instances that actually use Tomcat Native and are configured for client-certificate verification are exposed; no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation. Vendor-released fixes are available in 2.0.16 and 1.3.9.
Heap corruption triggered by a race condition in the Zscaler Client Connector (ZCC) ZPA tunnel handler allows remote, unauthenticated attackers to crash the client process and, under conditions requiring successful heap grooming, potentially execute code in the context of that process. Only ZCC builds below 4.6.0.486, 4.7.0.350, 4.8.0.267 and 4.9.0.412 are affected, and the practical outcome is more reliably a denial-of-service (client crash) than dependable code execution because the underlying race is non-deterministic and hard to win. No public exploit has been identified at time of analysis and the risk is low-immediacy (EPSS ~0.23%, 14th percentile; SSVC Exploitation: none, Automatable: no), despite the vendor's CVSS 8.1 rating.
Local privilege escalation or denial-of-service in the Linux kernel's RDMA/mlx4 InfiniBand driver stems from improper RCU synchronization in mlx4_srq_event(), where the mlx4_srq structure is never freed via RCU and can be accessed before initialization completes. Local low-privileged users on systems using Mellanox ConnectX (mlx4) RDMA hardware can trigger a race condition leading to memory corruption or kernel crash, with CVSS 7.8 reflecting high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS scores this at just 0.02%, indicating minimal real-world exploitation likelihood.
Denial of service in GNU C Library 2.36 on x86_64 systems occurs when nscd-backed functions trigger a race condition in the optimized memcmp implementation, allowing concurrent thread modification of input data to cause application crashes. This affects any application using NSS caching functionality under high load conditions. No patch is currently available.
Commerce Cloud versions up to 2205 contains a vulnerability that allows attackers to a cart entry being created with erroneous product value which could be checked o (CVSS 5.9).
Outray versions prior to 0.1.5 lack database transaction locking in the subdomain creation API endpoint, allowing authenticated users to bypass rate limits and provision more subdomains than permitted by their service tier. Public exploit code exists for this vulnerability, which affects the quota enforcement mechanism for free plan users. Upgrade to version 0.1.5 or later to remediate.
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XZ Utils provide a general-purpose data-compression library plus command-line tools. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable.