Race Condition

Arbitrary PHP code execution in ClipBucket v5 prior to 5.5.3-#40 through a race condition in file upload validation, where files are moved to a web-accessible directory before security checks are performed. An authenticated attacker can exploit the time window between file placement and validation deletion to execute malicious PHP code on the server. Public exploit code exists for this vulnerability.

Authenticated users can exploit a race condition in GitHub Copilot and Visual Studio Code to execute arbitrary code remotely by manipulating file state between verification and use. This vulnerability affects users with network access to these development tools and requires user interaction to trigger. No patch is currently available to address this high-severity flaw.

Windows HTTP.sys contains a race condition between privilege checks and resource access that enables local authenticated users to escalate privileges on Windows 10 21H2, Windows 11 23H2, and Windows Server 2025. An attacker with valid credentials can exploit this timing vulnerability to gain system-level access. No patch is currently available for this vulnerability.

Local privilege escalation in Windows Subsystem for Linux affects Windows 11 23h2 and Windows 10 22h2 through a race condition in shared resource synchronization. An authenticated local attacker can exploit this vulnerability to gain elevated privileges on the system. No patch is currently available for this vulnerability.

Local privilege escalation in Windows Connected Devices Platform Service exploits a race condition in resource synchronization, allowing authenticated attackers to gain elevated privileges on affected Windows systems including Server 2022, Windows 11 25h2, and Windows 10 21h2. The vulnerability requires local access and user interaction is not needed, making it a practical attack vector for users with standard privileges. No patch is currently available.

Windows Kernel privilege escalation vulnerability in Windows 10 21H2 and Windows Server 2012 stems from improper synchronization of concurrent access to shared resources, enabling local authenticated users to gain elevated system privileges. The race condition can be triggered without user interaction and impacts confidentiality, integrity, and availability of the affected system. No patch is currently available.

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. [CVSS 7.1 HIGH]

Local privilege escalation in BuhoCleaner 1.15.2 for macOS lets an authenticated unprivileged user gain root by abusing an insecurely implemented XPC helper service that performs privileged operations without properly validating or synchronizing its callers. The flaw is a CWE-362 race condition (TOCTOU) in the XPC service's privileged functions. No public exploit has been identified at time of analysis and EPSS is negligible (0.01%), consistent with a local-only, non-wormable weakness rather than a mass-exploited network bug.

Linux kernel ublk subsystem suffers from a use-after-free vulnerability in partition scan operations where a race condition between device teardown and asynchronous partition scanning allows local attackers with user privileges to access freed memory, potentially causing denial of service or information disclosure. The vulnerability stems from improper reference counting of disk objects during concurrent operations, affecting all Linux systems with the vulnerable ublk driver. A patch is available to resolve this issue by implementing proper disk reference management in the partition scan worker.

Arbitrary code execution with Administrator privileges in Rufus versions 4.11 and below due to a race condition in PowerShell script handling within the %TEMP% directory. A local attacker can replace the legitimate Fido script with malicious code between file creation and execution, since Rufus runs elevated but writes to a world-writable location without file locking. Public exploit code exists for this vulnerability, which is fixed in version 4.12_BETA.

Heap use-after-free in FreeRDP versions before 3.20.1 stems from unsynchronized access to serial channel thread tracking structures, allowing remote attackers to trigger memory corruption and achieve code execution. The vulnerability affects systems using vulnerable FreeRDP versions for remote desktop connections and has public exploit code available. No patch is currently available, requiring users to upgrade to version 3.20.1 or later.

Privilege escalation in Windows 11 and Windows Server 2025 Capability Access Management Service results from a race condition in resource synchronization, enabling authenticated local users to gain elevated system privileges. The vulnerability affects multiple recent Windows versions (24h2 and 25h2) and currently lacks a patch. No public exploit code has been disclosed, though the attack requires local access and moderate complexity to execute.

Privilege escalation in Windows SMB Server (Server 2025, Windows 11 24H2, Windows 10 22H2) stems from improper synchronization of shared resources during concurrent execution, enabling authenticated network attackers to gain elevated privileges. The vulnerability requires high complexity exploitation but carries high impact across confidentiality, integrity, and availability. No patch is currently available.

Privilege escalation in Windows SMB Server (versions 10 22h2, 11 23h2, and 11 25h2) stems from improper synchronization of shared resources, allowing authenticated network attackers to elevate privileges. The race condition vulnerability requires specific timing conditions but carries high impact across confidentiality, integrity, and availability. No patch is currently available for this vulnerability.

Privilege escalation in Windows Management Services via use-after-free memory corruption affects Windows 10, Windows 11, and Windows Server 2019, enabling authenticated local attackers to gain elevated system privileges. An authorized user can exploit this vulnerability through a race condition to execute arbitrary code with higher privileges. No patch is currently available for this vulnerability.

Privilege escalation in Windows SMB Server (2022, 2025) stems from improper synchronization of concurrent resource access, enabling authenticated network attackers to gain elevated privileges. The vulnerability requires specific conditions to trigger but provides high-impact unauthorized access when successfully exploited. No patch is currently available for affected systems.

Windows SMB Server contains a race condition in concurrent resource handling that enables authenticated network attackers to escalate privileges on affected systems including Windows 10 22H2, Windows 10 1607, and Windows Server 2025. The vulnerability requires low attack complexity and network access from an authenticated user, but carries high impact across confidentiality, integrity, and availability. No patch is currently available for this HIGH severity issue (CVSS 7.5).

Windows Management Services on Windows 10 and 11 contains a race condition in shared resource synchronization that enables authenticated local users to escalate privileges to system level. The vulnerability affects multiple Windows versions including 22h2, 21h2, and 25h2 builds, with no patch currently available.

Privilege escalation in Windows Management Services affects Windows 10 22h2, Windows Server 2022 23h2, and Windows 11 23h2 through a use-after-free memory flaw. An authenticated local attacker can exploit this vulnerability to gain elevated system privileges. Currently, no patch is available.

Privilege escalation in Windows Management Services on Windows 10 and 11 stems from improper synchronization of shared resources, enabling local authenticated attackers to gain elevated privileges. The race condition can be exploited without user interaction and impacts confidentiality, integrity, and availability across system boundaries. No patch is currently available for this vulnerability.

Privilege escalation in Windows Management Services (Windows 10/11) stems from improper synchronization of shared resources, allowing authenticated local users to gain elevated privileges through race condition exploitation. The vulnerability affects multiple Windows versions including 22H2 and 24H2 builds, with no patch currently available. An attacker with valid credentials can leverage this flaw to escalate from a standard user account to system-level access.

Local privilege escalation in Windows Local Session Manager (LSM) across Windows 11 23h2, Windows Server 2012, and 2019 stems from improper synchronization in shared resource handling, enabling authenticated attackers to elevate privileges on affected systems. The vulnerability requires local access and specific timing conditions to exploit, with no patch currently available. This affects systems running the impacted Windows and Server editions where authenticated users may achieve system-level privileges.

Local privilege escalation in Windows Management Services affects Windows Server 2019, Windows 11 24h2, and Windows Server 2025 through improper synchronization of shared resources, enabling authenticated users to gain elevated system privileges. The vulnerability exploits a race condition that an attacker can trigger without user interaction, though no patch is currently available.

Windows Management Services on Windows 10 and Windows Server 2019 contains a race condition in shared resource synchronization that enables local privilege escalation for authenticated users. An attacker with local access can exploit improper locking mechanisms to gain elevated system privileges. No patch is currently available for this vulnerability.

Windows Management Services on Windows 10 and Windows Server 2022 contain a race condition in shared resource handling that permits authenticated local attackers to escalate privileges to system level. The vulnerability stems from improper synchronization during concurrent operations and affects multiple Windows versions including Windows 10 22H2 and 1809. No patch is currently available for this high-severity issue (CVSS 7.8).

Privilege escalation in Windows Management Services affects Windows 10, Windows 11, and Windows Server 2022 through a use-after-free memory vulnerability. An authenticated local attacker can exploit this flaw to gain elevated system privileges. Currently no patch is available and exploitation requires specific conditions to trigger.

Windows WalletService contains a race condition that permits local privilege escalation on Windows 10 and Windows 11 systems. An unauthenticated attacker with local access can exploit improper synchronization of shared resources to gain elevated privileges. No patch is currently available for this vulnerability.

Privilege escalation via race condition in Windows SMB Server affects Windows 10 21h2, Windows 11 25h2, and Windows Server 2022 23h2, allowing authenticated attackers to gain elevated privileges over the network. The vulnerability stems from improper synchronization when handling concurrent access to shared resources, and no patch is currently available. With a CVSS score of 7.5, this poses a significant risk to organizations using affected Windows versions.

Windows Clipboard Server contains a use-after-free vulnerability affecting Windows 10 (versions 21H2 and 1809) and Windows Server 2022 (23H2) that enables local privilege escalation without requiring user interaction. An attacker with local access can exploit this memory safety flaw to gain elevated system privileges. No patch is currently available for this vulnerability.

Privilege escalation in the Graphics Kernel on Windows 11 and Linux systems results from improper synchronization of concurrent access to shared resources, allowing authenticated local attackers to gain elevated privileges. The vulnerability requires specific timing conditions to exploit but impacts multiple Windows versions and Linux distributions. No patch is currently available for this race condition vulnerability.

Privilege escalation in Windows Server 2025 Capability Access Management Service stems from improper synchronization of shared resources, enabling authenticated local users to gain elevated privileges. The race condition requires specific timing conditions but no patch is currently available, leaving affected systems vulnerable to privilege escalation attacks by authorized local users.

Local privilege escalation in the Tablet Windows User Interface (TWINUI) subsystem of Microsoft Windows lets an already-authenticated low-privileged user win a race condition (CWE-362) to gain higher privileges. The flaw spans a broad range of client and server builds (Windows 10 1607 through Windows 11 25H2, Windows Server 2016 through 2025) and, per its high-integrity/high-confidentiality/high-availability impact, can yield full SYSTEM-level control on a compromised host. No public exploit identified at time of analysis, and EPSS rates near-term mass exploitation as very low (0.03%).

Privilege escalation in Windows 11 and Windows Server 2025 Capability Access Management Service stems from improper synchronization of shared resources, enabling a local authenticated attacker to gain elevated privileges. The vulnerability exploits a race condition that can be triggered without user interaction, though successful exploitation requires specific timing and system conditions. No patch is currently available for this high-severity issue.

Privilege escalation in the Graphics Kernel affects Linux, Windows Server 2016, and Windows 10 1607 through a race condition in shared resource synchronization. A local authenticated attacker can exploit this vulnerability to gain elevated privileges on the affected system. No patch is currently available for this vulnerability.

Privilege escalation in Windows Printer Association Object affects Windows 11 and Windows Server 2022/2025 through a race condition in shared resource access. An authenticated local attacker can exploit improper synchronization to gain elevated system privileges. No patch is currently available for this vulnerability.

Concurrent requests in axios4go prior to version 0.6.4 trigger unsynchronized mutations to the shared HTTP client configuration, allowing attackers to manipulate transport settings, timeouts, and redirect handlers across simultaneous operations. Applications using async requests or multiple goroutines with different proxy configurations or handling sensitive credentials are vulnerable to request interception, credential leakage, or denial of service. Upgrade to version 0.6.4 or later to resolve this race condition.

Windows Kernel contains a race condition vulnerability enabling local privilege escalation through concurrent resource access with improper synchronization.

Concurrent write access to AF_ALG cryptographic sockets in the Linux kernel corrupts internal socket state and interleaves cryptographic data in an unpredictable manner, undermining the integrity and availability of kernel crypto operations for local users. The flaw spans multiple stable kernel branches up to and including 6.17-rc4, with six upstream patch commits available. No public exploit or active exploitation has been identified; the Siemens SSA-019113 advisory confirms downstream impact on industrial and embedded Linux-based products.

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.

A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

Windows User Profile Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. Rated medium severity (CVSS 6.4). No vendor patch available.

A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.

Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

A race condition was addressed with improved state handling. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public exploit code available and EPSS exploitation probability 82.9%.

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 34.9%.

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev) and public exploit code available.

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Qt6 WebEngine (qt6-qtwebengine) on Alpine Linux has been patched in package version 6.10.1-r7, addressing an unspecified vulnerability. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS score, CWE classification, or vendor advisory narrative has been published at time of analysis. Alpine Linux is the sole reporting source, and the fix is confirmed present in the Alpine package repository at version 6.10.1-r7.

Exception-detail disclosure in the Wheels CFML framework (versions 3.0.0 through 4.1.1) lets a remote, unauthenticated client receive full stack/exception details when the non-default setting allowIPBasedDebugAccess=true is enabled. Because error and debug-display flags live in shared application scope, an administrator request that changes those settings can race with an unauthorized client's erroring request, so that client may receive tag context or a serialized exception and any sensitive data inside it - confidentiality only (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Practical risk is well below what the network vector suggests: exploitation requires both the explicitly enabled non-default configuration and a narrow timing window, the race does not bypass the production gate that protects developer tools, and there is no public exploit identified at time of analysis. The issue is fixed in 4.1.2.

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.

Denial of service in Nezha Monitoring 2.2.7 through 2.2.10 lets an authenticated RoleMember crash the whole dashboard process by racing their own agent's TCP/ICMP result report against deletion of a service the member owns, producing a nil pointer dereference in ServiceSentinel.worker that panics the process and takes down every tenant's web interface, REST API, and agent connections until the service is restarted. Confirmed actively exploited? No - no public exploit code or active exploitation has been identified at time of analysis, and the issue is availability-only (C:N/I:N/A:H) with no data disclosure or modification. The published CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) matches the assessed impact, but independent analysis rates attack complexity as High (AC:H) because the attacker must win a concurrency window between the ownership check and the pointer dereference; that window is retriable, so practical reliability is higher than a one-shot race would suggest.

A race condition (CWE-362) in the Windows Security Center component of Windows 11 allows an attacker who already holds high privileges on the host to escalate privileges locally, affecting Windows 11 24H2 (builds below 10.0.26100.9445), 25H2 (below 10.0.26200.9445), and 26H1 (below 10.0.28000.2954). The attack is local-only and requires PR:H - the adversary must already be an authorized, high-privilege local user able to execute code and interact concurrently with the shared resource - and AC:H means success depends on winning a narrow, non-deterministic timing window, so repeated attempts are normally required. No public exploit code has been identified and CISA's SSVC assessment rates exploitation as 'none', making this a moderate-priority local elevation issue rather than a widespread-exploitation emergency, despite the high technical impact of the race class and its presence in a ubiquitous platform.

Local information disclosure in the Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) is caused by a use-after-free condition reached through a race in socket handling, allowing an attacker who can already log on to a host and execute code to read kernel memory that they should not be able to access. Exploitation is confined to an authenticated local attacker (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 4.7) who must win a non-deterministic kernel race, so repeated timing attempts are typically required and reliability is limited; there is no remote network path and no cross-component scope change. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so despite the HIGH confidentiality label the real-world priority is low-to-moderate.

Spoofing of integrity-protected state inside Windows Virtualization-Based Security (VBS) enclaves is possible on affected Windows 11 and Windows Server builds because of improper synchronization of a shared resource (CWE-362) within the enclave code path. An attacker must already hold authenticated low-privileged code execution on the local host (AV:L, PR:L) and then win a competitive timing race (AC:H) to tamper with enclave-managed data; the changed scope (S:C) reflects that the impact crosses from the attacker's user-mode context into the enclave security boundary, producing high integrity impact with no confidentiality or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment classifies the issue as non-automatable with only partial technical impact.

Heap use-after-free in FreeRDP smartcard emulation affects versions 3.0.0 before 3.32.0 and allows a malicious RDP server to crash the connecting client process by racing SCARD_IOCTL_DISCONNECT against SCARD_IOCTL_TRANSMIT on a single smartcard handle. Exploitation is remote and unauthenticated but requires the victim to initiate a session to an attacker-controlled or compromised server, smartcard redirection/emulation to be enabled, and the attacker to win a non-deterministic timing window; the independently assessed impact is availability-only heap corruption and termination, not code execution. No public exploit code or CISA KEV active exploitation was identified at time of analysis.

Race condition in the coupon redemption flow of macrozheng mall through version 1.0.3 allows an authenticated low-privilege user to issue parallel requests to /order/generateOrder reusing the same couponId and win a narrow time-of-check/time-of-use window, redeeming a single coupon more than once. The impact is confined to integrity - coupon double-redemption - with no confidentiality or availability effect, no code execution, and no unauthenticated path; the assessed vector is AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, matching the vendor-supplied CVSS 4.0 base score of 2.3. Exploitation is difficult due to the required request timing, no public exploit code has been identified, and there is no confirmed active exploitation (not in CISA KEV), making this a low-priority finding.

Limited information disclosure and limited integrity tampering in Mozilla Firefox versions prior to 158 arise from a race condition (CWE-362) in the browser's Networking: DNS component, fixed by Mozilla in Firefox 158. Winning the race is non-deterministic and requires the victim to interact with attacker-influenced web content (UI:R) that drives the DNS resolution code path, which is why the high attack complexity (AC:H), the modest CVSS 3.1 base score of 4.2, and CISA's SSVC 'Automatable: no' rating all point to a constrained, opportunistic issue rather than a reliable remote compromise; no public exploit identified at time of analysis, and no KEV listing. Impact is bounded to partial confidentiality and integrity loss with no availability effect, so this is a genuinely low-to-moderate priority issue rather than a high-severity emergency.

A non-deterministic timing race in Mozilla Firefox's XPCOM component can be won by attacker-controlled web content to yield limited information disclosure and a small integrity impact inside the browser, affecting Firefox builds prior to 158 and Firefox ESR builds prior to 153.5. Exploitation requires the victim to load or interact with attacker-supplied content (UI:R) and to hit a narrow, hard-to-reproduce race window (AC:H); no credentials are required (PR:N), and impact stays at low confidentiality and integrity with no scope change and no availability effect. Risk is low across every signal available: EPSS 0.19% (8th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, while vendor-released patches (Firefox 158 and Firefox ESR 153.5) are already available.

Use-after-free triggered by a race condition in Mozilla Firefox's Graphics: Text rendering component allows remote attackers to achieve limited confidentiality and integrity impact (CVSS 4.2) when a victim loads attacker-controlled web content. The vulnerability affects Firefox builds before 158 and Firefox ESR before 153.5, and is mitigated in practice by a high attack complexity (AC:H) - exploitation depends on winning a non-deterministic timing window, cannot be automated at scale (CISA SSVC Automatable: no), and requires the victim to actively navigate to crafted content (UI:R, PR:N). There is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis; the issue is rated low-to-moderate priority, with independent assessment and vendor data in agreement.

Use-after-free in Mozilla Firefox's Graphics: CanvasWebGL component - triggered by a race condition (CWE-362) in the WebGL/canvas rendering path - allows a remote attacker who convinces a victim to load crafted web content to win a non-deterministic timing window and achieve limited information disclosure or limited data modification (CVSS 3.1: 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Only unpatched installations below Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are exposed; the issues were remediated in the Mozilla Foundation Security Advisories mfsa2026-106, mfsa2026-107, and mfsa2026-108. Exploitation is not observed by CISA's SSVC assessment (Exploitation: none) and no public exploit code has been identified at time of analysis; the high attack-complexity rating, mandatory user interaction, and lack of availability or code-execution impact keep this a genuinely low-priority memory-safety issue.

Availability loss in Zephyr RTOS Bluetooth Mesh affects nodes built with the default access-layer delayable message queue, where an unsynchronized race between the host RX thread and the system workqueue lets the handler touch a context slot that has already been purged. The attacker must be a provisioned mesh member - holding the NetKey and a bound AppKey - within Bluetooth radio range, who can control arrival rate, response size and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and force the purge path; the trigger is a narrow, high-complexity race. Winning it produces a read-modify-write through a NULL-based pointer on the system workqueue thread, which on typical targets faults and aborts that thread (stopping all workqueue-driven functionality, including the mesh timing machinery) or resets the node, so impact is availability only - the write value and address are fixed, so there is no memory corruption or code execution path. Scoring is CVSS 3.1 4.8 (AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, and there is no KEV listing.

Race condition in the Pixelite Events Manager WordPress plugin (versions through 7.4.7) lets a remote, unauthenticated attacker target a narrow synchronization window in the plugin's handling of a shared resource, resulting in a limited integrity impact with no confidentiality or availability effect. Exploitation hinges on winning a concurrency race - tightly-timed overlapping requests must land inside the vulnerable window (CVSS AC:H), a probabilistic timing requirement that substantially reduces reliability and keeps overall severity low. No public exploit has been identified at time of analysis, and there is no confirmed active exploitation (no CISA KEV listing).

Heap buffer over-write in ImageMagick versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) is triggered when the security policy is read and written concurrently by multiple threads, crashing the application and causing a denial of service. Exploitation requires local low-privileged code execution (CVSS:4.0 AV:L/PR:L) inside a process that embeds the library and that modifies its policy at runtime, combined with winning a probabilistic timing race (AT:P); the flaw yields no confidentiality or integrity impact, only availability loss. No public exploit code has been identified at time of analysis, and vendor-released patches are available as 6.9.13-57 and 7.1.2-32.

Authenticated participants of the Meetecho Janus Gateway VideoRoom plugin can bypass a room's max_publishers cap by winning a narrow timing race between a session's 'starting' and 'started' states, allowing more concurrent publishers in a room than the operator configured (CWE-362). The issue is a low-severity one: it requires an authenticated, low-privileged VideoRoom participant able to send 'publish' requests, only matters for rooms that actually enforce a publisher limit, and yields only Low integrity and Low availability impact with no confidentiality loss (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L; CVSS 4.0 base 2.3 with AC:H and E:P). Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the vendor responded quickly with an upstream fix in PR #3678 (commit 27c0d1af888153e818675b56a4e6267f62d57097).

Out-of-bounds read of up to roughly 64 KiB in Zephyr's ITE IT8xxx2 SHI host-command backend allows an attacker who drives the SPI host controller to disclose adjacent embedded-controller SRAM to the host, or to fault the controller by reading past the end of SRAM. The root cause is a race: the 8-byte host-command header is copied from the SPI Rx FIFO directly into the shared in_msg buffer before the protocol version and derived packet length are validated, so a second transaction carrying data_len = 0xFFFF can deposit its header into a buffer that verify_rx() has already accepted; if those bytes land before the host-command thread assigns args.input_buf_size = rx_header->data_len, a registered handler is handed a 65535-byte length over a 256-byte buffer. Exploitation requires local control of the inter-processor SHI bus (a compromised host OS driving chip select and clock, or physical access to the SPI lines) plus a timing race the host can retry indefinitely, and is unauthenticated per the CVSS vector (PR:N); no public exploit code or confirmed active exploitation was identified at time of analysis.

Denial of service in IBM Guardium Data Protection 12.2.2 allows remote unauthenticated attackers to degrade availability by racing concurrent unsynchronized writes to a shared map. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes availability-only impact with no confidentiality or integrity loss; our assessment refines attack complexity to AC:H because the non-deterministic race window reduces reliability below AC:L. No public exploit identified at time of analysis, and a vendor patch is available via IBM Support node 7288627, so patched or non-12.2.2 deployments are not exposed.

Race condition in the WordPress plugin Tutor LMS (Themeum) affecting versions through 4.1.1 lets an authenticated attacker with low privileges exploit improper synchronization of a shared resource by firing overlapping concurrent requests in order to win a timing window, with the assessed impact limited to integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). Because exploitation requires a valid low-privileged account and depends on a non-deterministic concurrency race (AC:H, SSVC Exploitation: none, Automatable: no), successful abuse is probabilistic rather than reliable. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a genuine but moderate-priority issue for sites exposing Tutor LMS to registered users rather than an emergency.

Incorrect client-IP attribution inside the Brocade Fabric OS web management daemon lets an authenticated, adjacent-network attacker win a timing race and potentially slip past AAA evaluation or Calling-Station-ID ACL policies on switches running Fabric OS before 10.0.1. Because the PAM modules in the multi-threaded execution pool can pick up stale or mismatched client IP addresses and switch context numbers, audit records can be misattributed and IP-keyed policy decisions can be made against the wrong session. Impact is limited to integrity of low severity (CVSS 4.0 2.1 / assessed CVSS 3.1 5.0-style low), exploitation is probabilistic rather than reliable, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Race-condition information disclosure in Brocade Fabric OS before 10.0.1 allows a low-privilege authenticated attacker on an adjacent/management network to obtain limited management or configuration data belonging to another concurrent FCIP request. The issue requires precise timing to win the narrow window between address-variable population and response construction, making exploitation non-deterministic and limited to partial data exposure; no public exploit identified at time of analysis. With CVSS 2.1 and no integrity or availability impact, this is a low-priority information disclosure issue.

Concurrent HTTP POST requests to MISP's email OTP login endpoint can both authenticate using the same one-time password, breaking the single-use guarantee and establishing duplicate sessions. Affected versions before 2.5.48 are vulnerable when email OTP login is enabled; exploitation requires the attacker to already hold a valid, unexpired OTP (via interception or social engineering) and to time two requests within the narrow race window. No public exploit code or active exploitation has been identified, and the independent assessment rates this as a genuine but low-urgency integrity issue (CVSS 3.1 base 3.6, high attack complexity) because success merely duplicates a session the OTP already granted.

Obot versions 0.25.0 through 0.25.5 and 0.26.0 can persist stale group memberships after an administrator revokes a user's group in the upstream identity provider, leaving the user with revoked group-based access for roughly ten minutes. The flaw is a race condition (CWE-362) in the auth provider group-refresh path: when two refreshes for the same identity overlap and commit out of order, an older refresh overwrites the newer one and restores memberships that were just removed. It is a genuinely low-priority issue - the CVSS 4.0 score is 2.3 (assessed independently as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), exploitation requires an already-authenticated user (PR:L), the timing is not attacker-controllable (AC:H), impact is limited to retaining previously held access rather than gaining new privileges, and the condition self-heals within the group check period; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.

An unauthenticated remote attacker can exploit a race condition in Chromoting (Chrome Remote Desktop) within Google Chrome before version 155.0.8059.39 by socially engineering a victim into opening the vulnerable code path while delivering crafted network traffic, potentially bypassing system access restrictions. Exploitation requires the victim to be actively using Chromoting and to win a timing-dependent race condition (AC:H), making reliable attacks unlikely. The EPSS score is 0.14% (3rd percentile), the Chromium severity is Low, and no public exploit has been identified at time of analysis; the vendor has released a patch in 155.0.8059.39.

Cross-origin data leakage in Google Chrome is possible when a victim opens a crafted HTML page that triggers a race condition in the browser's WebAudio implementation; the issue affects all Chrome builds prior to 155.0.8059.39 on every platform covered by the generic CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The impact is confidentiality-only and low severity (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), requiring the user to interact with attacker-supplied content before any data can be exposed, and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as 'none', automatability as 'no', and technical impact as 'partial'. Google has released a vendor patch in Chrome 155.0.8059.39, so this is best handled as a low-to-moderate priority update rather than an emergency response, as reflected in our assessment that this is a genuinely low-to-moderate priority issue despite being in ubiquitous software.

Authenticated non-admin users can deadlock the alerting subsystem in Nezha 1.8.0 through releases before 2.3.13 by racing the notification-group UpdateGroup/DeleteGroup operations against the batch-delete endpoint with oversized id lists, closing an ABBA lock-order inversion that halts alert delivery until the service is restarted. This is an availability-only race condition (CWE-362) that requires a valid low-privileged account and successful timing; independent assessment maps it to CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H and rates it a moderate-severity issue rather than a top-tier priority. No public exploit identified at time of analysis, and no code execution, data access, or integrity impact is assessed.

Invalid intermediate VM state can be exposed in Wasmtime 46.0.0 through 46.0.1 and 47.0.0 through 47.0.2 when an embedder mutates a Store from inside its fuel or epoch preemption callback - or keeps using the Store after a trap/cancellation - while a guest is mid-way through a bulk operation such as memory.copy, table.grow, table.fill, or array.copy. Hitting that preemption window can leave null elements in a non-nullable table, invalidate retained raw pointers after linear-memory growth during memory.copy, or invalidate GC pointers when the callback triggers garbage collection during array.copy, yielding a crash, invalid memory access, or GC heap corruption (integrity and availability impact only, no confidentiality loss). Exploitation is gated on a non-default embedding configuration (assessed CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L; PR:H in the assessed vector), requires winning a timing race, and no public exploit has been identified at time of analysis. Vendor-released patches are available in Wasmtime 46.0.2 and 47.0.3.

Unauthenticated remote attackers can win a timing race against the booking/availability logic in WPdevelop's Booking Calendar WordPress plugin through version 11.8.4, producing inconsistent or corrupted booking state (integrity-only, CVSS 3.1 score 3.7). The scored vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that no credentials or user interaction are required, but success is non-deterministic and normally demands many rapid parallel requests to the public booking submission flow, with no data disclosure or availability impact. This is a low-severity, low-real-world-priority issue: there is no CISA KEV listing and no public exploit identified at time of analysis.

A race condition in Ghost CMS's staff invitation acceptance flow (affecting versions 0.5.0 through 6.22.x) allows someone holding a valid invitation token to create more than one user account from that single-use invite by firing concurrent acceptance requests before the token is marked consumed. The impact is integrity-only and low (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, matching the published 5.3), since exploitation is opportunistic rather than deterministic and requires a legitimately issued staff invite token; no public exploit code or confirmed active exploitation was identified at time of analysis. Ghost 6.23.0 contains the vendor fix.

An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux can be triggered by an already-privileged local user who wins a narrow race condition between concurrent kernel operations, potentially yielding code execution in kernel context, denial of service, privilege escalation, information disclosure, and data tampering. Affected branches include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver products on Linux (CVSS 3.1 base 6.4). Impact is bounded by the requirement for high local privileges (PR:H) and the non-deterministic nature of the race (AC:H); no public exploit code and no confirmed active exploitation were identified at time of analysis.

Time-of-check-to-time-of-use race condition in the account recovery endpoint of vulnerability-lookup (/user/confirm_account/<token>) allows two concurrent HTTP requests carrying the same valid single-use recovery token to both pass the nonce verification step before either transaction commits, so both callers set a password on the target account and the last commit wins. The same view also accepted empty or trivially short (three-character) passwords because it compared the two password fields manually instead of invoking the form's validation logic, bypassing the intended minimum-length and complexity constraints. No public exploit code has been identified at time of analysis, and although the requests are unauthenticated over the network (CVSS:4.0 PR:N), exploitation is gated by the hard prerequisite that the attacker already possesses a live, unconsumed recovery token for the target account plus the timing precision needed to win the race window - a combination the independent assessment captures in its CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N, keeping real-world risk moderate rather than critical.

OpenClaw npm package versions 2026.7.2 through 2026.9.1 contain a race condition in the Discord realtime voice transcript path that can cause an utterance from a non-owner participant to be processed at the downstream agent boundary as if it came from the session owner. The flaw is exploitable only in Discord agent-proxy voice sessions that use the realtime voice control path with an agent configured to distinguish owner from non-owner senders, and an admitted non-owner participant must produce concurrent control-classified transcripts that win a non-deterministic timing race against a legitimate owner's context. No public exploit identified at time of analysis; the vendor has fixed the issue in 2026.9.2, and while the CVSS 4.0 base score is 6.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N per independent assessment), real-world risk is LOW-to-MODERATE because exploitation is gated by precise timing, the specific realtime control path, and which owner-sensitive tools are actually exposed.

Uninitialized-mutex use in the Linux kernel Bluetooth HCI core can be triggered by a local low-privileged user who causes an HCI controller flagged with quirks such as HCI_QUIRK_RAW_DEVICE (and therefore HCI_UNCONFIGURED) to be registered while the power_on work item races ahead of msft_register() initialization. The window is a narrow timing race in hci_register_dev(), where hdev->msft_data is published before mutex_init(&msft->filter_lock) completes, so hci_power_on() -> hci_dev_do_close() -> msft_do_close() can lock an uninitialized mutex, producing a DEBUG_LOCKS warning and a kernel warning/backtrace (availability impact, no confidentiality or integrity effect). EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; vendor-released patches exist for the affected stable branches.

GitLab CE/EE instances running the Model Context Protocol (MCP) search tool can return search results under the wrong user's context when concurrent searches collide, allowing one authenticated user to view another user's search output. The flaw is a race condition (CWE-362) that affects versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1, and carries a low CVSS 3.1 base score with only a confidentiality impact; the timing window is non-deterministic and cannot be forced reliably. There is no public exploit identified at time of analysis and no CISA KEV listing, and deployment exposure is limited to instances that actually expose the MCP search tool to authenticated users.