Race Condition

Any Bluetooth device within radio range of a Reachy Mini robot can send CMD_ commands by piggybacking on another operator's completed PIN authentication, because the Bluetooth service keeps its authenticated state in a single shared flag on the service instance rather than binding it to the calling device - the WriteValue handler ignores the BlueZ options argument that carries the caller's identity. The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (6.3, Medium) reflects that Bluetooth proximity and a genuine user completing the PIN exchange are both required, and that standalone impact is limited to command access; root code execution only follows from chaining with CVE-2026-55419 (unrestricted file upload) and CVE-2026-62661 (path traversal in the Bluetooth command handler). No CISA KEV listing, no EPSS score, and no independently published standalone exploit code were identified at time of analysis - the only public documentation is JFrog's description of this as the second step in a three-step attack chain, with no public exploit identified at time of analysis for this issue alone.

Google Chrome desktop installations are affected by a flaw corrected in a stable channel update, with vendor patch data indicating a fix is available but no description, CVSS score, CVSS vector, or CWE supplied to characterize the defect. Because neither the affected component nor the attack vector is specified in the available intelligence, the impact cannot be assessed beyond Chrome's general exploitation model, in which a victim would need to load attacker-controlled web content for an exploit attempt to succeed. No public exploit identified at time of analysis, and Chrome's automatic-update mechanism sharply limits exposure so that primarily outdated installations remain at risk; the linked Chrome Releases advisory is the authoritative source for the exact affected build and fix.

Concurrent writes to the same Internal Trusted Storage (ITS) UID in Zephyr RTOS can be encrypted with a duplicate AEAD nonce, because the default nonce provider secure_storage_its_transform_aead_get_nonce() keeps its counter in unsynchronized function-local statics (no lock). Affected are builds using the PSA ITS secure-storage transform with AES-GCM or ChaCha20-Poly1305, an application that writes the same UID from two threads at once, and one of the shipped log-structured back-ends (zms.c or the settings/NVS store) whose deferred garbage collection leaves both racing ciphertexts resident in the raw partition. The impact is cryptographic rather than direct code execution: nonce reuse under the same derived key leaks the XOR of the two plaintexts (potentially PSA persistent keys stored in ITS) and, for GCM, exposes the authentication key, allowing forgery of stored entries - but only for an adversary with local read access to the raw backing flash, and only where the same UID is written concurrently. CVSS is 5.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N), no CISA KEV listing, and no public exploit identified at time of analysis; risk is heavily gated by the narrow race window and the per-UID key salting that makes cross-UID collisions harmless. An upstream fix commit that serializes the provider with a mutex is available.

A race condition in the Free5GC AMF network function, affecting releases up to and including 4.2.3, allows remote attackers to interleave GMM/NAS signalling with SCTP-association teardown so that concurrent unsynchronised access to the AmfUe.RanUe map occurs, which in Go produces a fatal "concurrent map read and map write" runtime error and crashes the AMF, disrupting UE registration and NAS transport for all attached subscribers. Both the supplier's CVSS 4.0 vector (6.9) and our independent assessment treat the flaw as unauthenticated (PR:N) but timing-dependent, with reach limited to the private 5G control plane - a malicious or compromised gNB, or a UE capable of driving registration/transport signalling over the N2 interface - rather than the public internet, and only availability is demonstrably impacted (C:N/I:N/A:H); the supplied "Information Disclosure" tag is not substantiated by the code path. No public exploit was identified at time of analysis (the supplier vector's E:P value reflects proof-of-concept-level maturity only), and an upstream fix is available as commit e323b01464355781b8b8d5dd695e05cbc00a62f2 (PR #238) that serialises RanUe access behind a sync.RWMutex.

Concurrent downgrade requests against Paymenter 1.5.6 and earlier can double-spend account credit: any authenticated customer with an active, downgradable service can fire parallel requests that each pass the unpinned Service::upgradable check and each credit the same balance, yielding N refunds for one downgrade. The inflated balance is real, spendable store credit, so an attacker can immediately settle invoices or provision services at the operator's expense; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this a moderate-severity business-logic flaw rather than a system-compromise vector, since it requires a qualifying service, the default credits-on-downgrade setting, and a race window that must be won. Vendor-released patch: 1.5.7.

An authenticated user with gRPC/gNSI access on Arista EOS can retain permissions that a security policy rotation was supposed to revoke, because a race condition in the gNSI Authz service causes the policy rotation to fail silently when multiple gNSI transports are configured on the device. Only non-default deployments with more than one gNSI transport are affected, Bootz is explicitly out of scope, and the flaw does not grant new privileges - it merely preserves access the attacker already legitimately held, so the outcome is a stale authorization state rather than a privilege escalation. Exploitation requires the revocation and the race to coincide, making it opportunistic rather than attacker-triggerable on demand; Arista discovered the issue internally and reports no malicious exploitation, and no public exploit code has been identified at time of analysis. The vendor's CVSS 4.0 score of 6.0 is well-calibrated for a genuinely moderate, not critical, issue.

UI spoofing in Google Chrome's WebAppInstalls subsystem - all builds prior to 153.0.8010.47 - lets a remote, unauthenticated attacker mislead a user with falsified interface elements (for example, a convincing install or permission prompt) rendered from a crafted HTML page. Per the assessed vector (AV:N/AC:H/PR:N/UI:R, C:N/I:L/A:N), exploitation depends on the victim actively visiting the attacker's page and on the attacker winning a timing race, which makes reliable abuse difficult and confines real-world impact to low-integrity visual deception rather than code execution, data disclosure, or denial of service; there is no public exploit identified at time of analysis, EPSS is a negligible 0.17% (7th percentile), and the issue is not in CISA KEV. Google has shipped a fix in Chrome 153.0.8010.47, so this is a low-priority, patch-and-move-on item with low risk across every signal.

A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.

Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.

Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).

Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.

A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.

A race condition in Apple macOS kernel locking allows a local user with existing code execution on the host to read kernel memory, fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local authenticated access and a high-complexity timing win in the kernel's locking path, so it is probabilistic rather than reliable, and the impact is limited to confidentiality (kernel memory disclosure) with no code execution, modification, or denial of service. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.19% (8th percentile), making this a genuine but low-priority issue.

A race condition in Apple macOS state management allows a locally executing application to read sensitive user data; the flaw is fixed in macOS Golden Gate 27, and all earlier macOS versions are affected. Exploitation requires an attacker-controlled or malicious app already running on the host (assessed as local, PR:L, not remote despite the vendor's AV:N/PR:N vector) and depends on winning a narrow timing window, which limits reliability. Impact is confidentiality-only - no integrity or availability effect - and no public exploit has been identified at time of analysis; EPSS is 0.14% (4th percentile), so opportunistic exploitation is unlikely, though the data-disclosure impact and Apple's ecosystem prominence keep patching worthwhile.

A race condition in Apple's kernel state handling lets a locally installed app corrupt kernel memory or trigger unexpected system termination across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. Apple addressed the flaw in iOS 18.7.10 and 26.6, iPadOS 18.7.10 and 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6, so exploitation is limited to unpatched devices running a malicious app plus user interaction. No public exploit code and no active exploitation are known; EPSS is 0.17% (6th percentile) and CVSS rates it 6.3, reflecting a local, high-complexity attack with no confidentiality impact.

A race condition in core Apple operating system components lets a locally installed app trigger an unexpected system termination on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Apple fixed the flaw through improved state handling in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27. Impact is availability-only (no data exposure or modification), exploitation requires a local malicious app and winning a timing window, EPSS is a low 0.21%, and no public exploit code or active exploitation has been identified at time of analysis.

Local applications running on Apple macOS releases prior to Tahoe 26.6 can exploit a race condition in the validation path guarding protected user data, allowing an app to read data it should not be able to reach. The flaw is mitigated in macOS Tahoe 26.6 per Apple's advisory, and the attack is timing-dependent and local-only (CVSS 4.7, AV:L/AC:H/PR:L), which keeps practical risk moderate. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.

A race condition in Apple's state-handling code allows a locally installed app to crash the system or cause unexpected termination of system processes on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. The flaw carries a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) — availability-only impact, local attack vector, high complexity — and is fixed in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and tvOS, visionOS and watchOS 27. Neither public exploit code nor CISA KEV activity has been recorded, and EPSS puts exploitation probability at roughly 0.2% (10th percentile), so this is a patching-hygiene item rather than an emergency.

A race condition in Apple's OS state-handling code (CWE-362) lets an application already executing on an affected device crash the system, causing unexpected termination and a local denial of service across iOS/iPadOS, macOS, tvOS, visionOS and watchOS. Only local, already-installed apps can reach the flaw (AV:L, PR:L), and because the attacker must reliably win a narrow timing window (AC:H), exploitation is difficult; there is no data exposure or code execution, only availability impact (CVSS:3.1 4.7). No public exploit code has been identified at time of analysis, EPSS is a low 0.18% (8th percentile), and vendor patches are already released in iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, so this is a low-to-moderate priority hardening item rather than an urgent threat.

A local race condition (CWE-362) in Apple macOS allows any locally running application to trigger unexpected system termination on affected hosts. The flaw affects macOS versions prior to Tahoe 26.7 and Golden Gate 27, is availability-only (C:N/I:N/A:H), and requires local app execution with no user interaction and no privilege escalation. Apple has released fixed versions; there is no public exploit identified, no CISA KEV listing, and EPSS is only 0.16% (5th percentile), indicating low real-world exploitation pressure.

Unexpected system termination in Apple operating systems can be triggered by a locally installed app that wins a race condition in system state handling, affecting iOS/iPadOS before 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, tvOS before 27, visionOS before 27, and watchOS before 27. The defect is availability-only (C:N/I:N/A:H) with a local attack vector (AV:L), high attack complexity (AC:H), and low privileges required (PR:L), meaning an authenticated app must hit a narrow timing window to crash the system. No public exploit identified at time of analysis and no confirmation of active exploitation (not in CISA KEV); EPSS is 0.20% (10th percentile), and Apple has released patched versions.

Unexpected system termination (denial of service) in Apple macOS stems from a race condition that a locally running app can win to crash the system; the flaw is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, so all earlier builds of those release trains are affected. Exploitation requires the attacker to already be able to execute code as a local app with low privileges (CVSS PR:L) and to repeatedly hit a narrow timing window (CVSS AC:H), with no user interaction required at exploit time and no confidentiality or integrity impact (C:N/I:N/A:H, base score 4.7). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.17% (6th percentile), so this is a low-to-moderate priority availability bug rather than a remote or code-execution threat.

A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.

Race condition in Yealink SIP-T33G firmware versions 124.86.x.x allows authenticated network users to abort active diagnostic operations by exploiting unsynchronized access to predictable output file paths. An attacker with low-level device credentials triggers a diagnostic tool such as ping or traceroute, then concurrently invokes the file deletion endpoint to remove the output file while it is being written, interrupting the running process and leaving the device in an inconsistent state. No public exploit has been identified and no active exploitation is recorded; the vendor has released a fix in firmware 124.87.0.0.

Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attackers to exploit improper synchronization during concurrent account-state operations, yielding limited confidentiality, integrity, and availability impacts. The project has been abandoned by its maintainer, who did not respond to disclosure, and operates on a rolling release model with no versioned releases - meaning no patch will be issued. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and high attack complexity rating indicate that reliable exploitation is difficult in practice.

Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers with low privileges to exploit concurrent state manipulation for limited confidentiality, integrity, and availability impacts. The affected product is an abandoned, unsupported open-source Cloudflare WARP license key management tool with no versioning scheme and an unresponsive maintainer. A public proof-of-concept exploit exists on GitHub, though the high attack complexity (AC:H) and requirement for prior authentication substantially limit real-world risk.

Race condition in Snipe-IT ≤8.6.3 allows two concurrent checkout requests for the same available asset to both pass the availability check and both commit, corrupting the audit trail with duplicate checkout-history rows, a doubled checkout_counter, and two spurious CheckoutableCheckedOut events. Authenticated users holding the assets.checkout permission can trigger this by issuing precisely timed concurrent HTTP requests. The visible asset assignment remains singular, so the primary tracking record is not altered, but reconciliation, utilization reporting, and ITSM integrations that rely on event counts or the checkout_counter are affected. No public exploit has been identified and CVSS 4.0 scores this 2.1 (Low).

Race condition in the Browser component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by inducing a victim to visit a crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L) reflects limited, non-scope-changing impact - this is not a sandbox escape but a partial access-control bypass within the Browser process. EPSS at 0.20% (10th percentile), Chromium's own 'Medium' severity rating, and the absence of KEV listing or public exploit code all converge on low near-term exploitation risk.

Race condition in the Payments component of Google Chrome prior to 153.0.8010.36 enables remote attackers to spoof payment UI elements by delivering a crafted HTML page combined with social engineering, requiring user interaction to trigger the vulnerable timing window. The CWE-362 race condition in Chrome's Payment Request handling allows the attacker to substitute or overlay legitimate payment dialogs with fraudulent ones during the race window, potentially tricking victims into submitting payment credentials to attacker-controlled endpoints. No public exploit code exists and EPSS of 0.14% (4th percentile) reflects very low exploitation probability; Chromium rates this Medium severity.

Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.

Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.

Xen hypervisor contains a race condition (XSA-509) during guest termination that allows a guest to induce its device model to re-establish IRQ tracking structures for PCI devices after those structures have already been torn down in the cleanup sequence. At least one of the re-established tracking structures is never subsequently freed, resulting in a resource leak that can impact hypervisor availability. With a CVSS S:C/A:H impact and PR:L, a low-privileged guest user can affect the hypervisor domain - making this a guest-to-hypervisor containment issue, not merely a local self-DoS. EPSS is low at 0.17% and no public exploit or CISA KEV listing exists at time of analysis.

Race condition in freegpt-webui's Jailbreak Mode allows remote attackers to trigger low-level availability disruption by exploiting improper synchronization in the `getJailbreak` function of `server/config.py`. The affected project is end-of-life and unmaintained, with no versioned releases due to its rolling-release model. Public exploit code exists via a referenced GitHub gist, though exploitation demands high attack complexity and produces only minor service disruption - no confidentiality or integrity impact is possible.

Race condition in jofpin trape 2.0 allows remote unauthenticated attackers to manipulate telemetry data via the vId argument in core/user.py's Telemetry Endpoint, yielding low-impact confidentiality, integrity, and availability compromise. Exploitation is rated high complexity (AC:H) due to the timing requirements inherent in race condition attacks, and the CVSS 4.0 base score is 2.9. A public proof-of-concept exists as a GitHub issue report (#408); the project maintainer has not responded to the disclosure.

Race condition in Zephyr RTOS's I3C IBI workqueue subsystem allows a physically-present attacker controlling an I3C peripheral to corrupt kernel memory structures, most realistically causing denial of service. The unsynchronized free-list (sys_slist_t) shared between ISR context and the workqueue handler thread creates a window where a work node can be handed to two consumers simultaneously or a garbage pointer can be dereferenced in a memcpy, producing an out-of-bounds write. No public exploit code has been identified and no CISA KEV listing exists; the patch wrapping all free-list operations in a k_spinlock is confirmed in upstream commit e87e7e2.

Race condition exploitation in FileCodeBox's Pickup Limit Handler allows remote unauthenticated attackers to bypass configured file download quotas by sending concurrent retrieval requests. The flaw exists in the `update_file_usage` function (`apps/base/views.py`) across all releases prior to v2.5.0 - including v2.4.0 despite the CVE description citing only 'up to 2.3'. A public proof-of-concept is available via GitHub issue #482, though no active exploitation has been confirmed by CISA KEV. The vendor-released fix is confirmed in v2.5.0 via commit 8d7d856.

Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.

Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.

Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Cross-user data disclosure in SvelteKit (npm/@sveltejs/kit versions 2.38.0 through 2.60.0) stems from a race condition in the query.batch() API that can cause concurrent HTTP requests from different authenticated users to merge under a single shared request context. Successful exploitation allows one user to receive response data belonging to another user's simultaneous session, including potentially sensitive application state. Vendor-released patch version 2.60.1 is available; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.

Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.

Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.

Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.

Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.

Process-crashing race condition in the OpenTelemetry-Go OpenTracing bridge (`go.opentelemetry.io/otel/bridge/opentracing`) allows denial of service when concurrent goroutines access the same `bridgeSpan` - one writing baggage via `SetBaggageItem` and another reading it via `correlation.MapFromContext`. Because Go's runtime detects unsynchronized map access and terminates the process with a fatal panic, any application using the bridge with correlation hooks and concurrent span access is vulnerable to abrupt process termination. A proof-of-concept is publicly available; no confirmed active exploitation (KEV) has been reported.

Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.

Unauthenticated model content injection in Splunk AI Toolkit below 6.0.0 allows an authenticated attacker with model upload privileges to overwrite another user's in-progress model upload by racing concurrent requests to the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The root cause is the toolkit's failure to bind uploaded file content to the specific request that creates the corresponding model lookup entry, enabling a TOCTOU-style substitution. No public exploit code or CISA KEV listing has been identified; the vendor (Splunk) has released a patch in version 6.0.0.

Race condition in Firefox's JavaScript Engine (CVE-2026-74984) exposes users on all Firefox versions prior to 154 and ESR versions prior to 153.1 to potential confidentiality and integrity compromise. The CWE-362 flaw creates a timing window during concurrent JavaScript execution in which an attacker-controlled script can race against the engine's internal state management, enabling memory read or write access. No public exploit code has been identified and EPSS sits at the 5th percentile, indicating no widespread exploitation at time of analysis.

Login lockout bypass in Zabbix API and Frontend enables brute-force attacks beyond intended limits by exploiting a race condition in the block counter. Simultaneous login requests are not properly synchronized against the lockout mechanism, allowing unauthenticated remote attackers to submit more credential guesses than the lockout policy permits. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, no-authentication-required attack surface lowers the barrier for credential-stuffing campaigns against Zabbix deployments.

Memory corruption via race condition in Safari's web content processing causes unexpected application crashes on iOS, iPadOS, and macOS. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2, covering both the legacy 18.x and current 26.x release trains. No public exploit identified at time of analysis, and exploitation requires high attack complexity due to the race condition timing requirement, making opportunistic mass exploitation unlikely.

Memory corruption via a race condition in Apple's web content processing engine (WebKit) causes Safari to crash when a user loads maliciously crafted content on iOS, iPadOS, or macOS Tahoe. The root cause is an improper locking deficiency (CWE-362), confirmed by Apple's own description of the fix as "improved locking." No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Apple has released patches across all affected platforms.

Quota bypass via Redis cache race condition in New API (QuantumNous LLM gateway) allows any authenticated low-privilege user to keep their cached quota balance artificially inflated by flooding PUT /api/user/self with settings updates while concurrently consuming quota. The settings update path reads a stale full User snapshot and writes it back via RedisHSetObj, atomically overwriting HINCRBY billing deductions applied by concurrent relay requests to the same Redis hash key. No public exploit has been identified and the vulnerability is not listed in CISA KEV; however, the financial integrity impact on operators is concrete, as affected users can make LLM API calls well beyond their paid allocation without detection until a database reconciliation occurs.

Race condition in KUNBUS piControl 2.6.2 enables a local authenticated attacker to corrupt kernel heap memory and disclose adjacent kernel memory contents by issuing concurrent crafted requests through the piControl character device. The flaw resides in the event notification subsystem, where improper synchronization between threads allows an attacker to win a timing window and manipulate shared kernel state. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.9 reflects the high-complexity, local-access nature of the attack.

Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant guard introduced for CVE-2025-62164, permitting an invalid sparse tensor to reach `tensor.to_dense()` and cause availability disruption. Affected deployments span versions 0.20.2rc0 through 0.25.x and are limited to instances with `enable_prompt_embeds` explicitly enabled. No public exploit code or CISA KEV listing exists at time of analysis; the fix is confirmed in v0.26.0.

Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.

Race condition in IBM DataPower Gateway across three concurrent version lines (10.5.0.x, 10.6.0.x, and 11.0.0.x) permits state contamination of the built-in X-Client-IP header under concurrent request load, enabling IP spoofing and cross-client IP address disclosure. The flaw resides in IBM's enterprise API gateway and integration middleware, commonly deployed in high-throughput service meshes where simultaneous request processing is routine. IBM has released a patch via advisory 7282770, and no public exploit has been identified at time of analysis.

IBM i versions 7.3 through 7.6 expose sensitive information to remote authenticated attackers via a race condition (CWE-362). The flaw allows a low-privileged network-authenticated user to read data outside their authorization boundary during a timing window in an undisclosed subsystem. Vendor-released patch is available; no public exploit code exists and the vulnerability is not listed in CISA KEV.

Remote authenticated exploitation of a race condition in IBM i 7.3 through 7.6 allows attackers with low-privilege credentials to obtain sensitive information and bypass platform security restrictions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network without user interaction, though authentication is required. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via its support portal.

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the execution of hid_device_io_start() within the driver probe function. If the probe operation fails after "io start" has been initiated, this race condition will result in a UAF vulnerability. Fix the problem by calling hid_device_io_stop() before calling hid_hw_stop().

In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is enabled, async !wait calls use the destination CPU csd_data. That improves diagnostics, but it also removes the single-writer property that made the old csd_lock() safe: multiple CPUs can now prepare the same destination CPU CSD concurrently. csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the bit with a non-atomic read-modify-write. Two senders can both see an unlocked CSD, set the bit, overwrite the callback fields, and enqueue the same llist node. Re-adding a node that is already the queue head can make node->next point to itself, leaving the target CPU stuck walking call_single_queue. Later synchronous work, such as a TLB shootdown, can then remain queued and trigger soft-lockup warnings or panics. Keep the single csd_lock() implementation, but when CSD lock debugging is enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the destination CPU CSD a real atomic lock in the only configuration where it can be shared by multiple remote senders, while preserving the existing non-debug fast path.

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.

Remote code execution via race condition in Windows DNS affects authorized, high-privileged attackers across a broad range of Windows Server and Windows client versions. The CWE-362 race condition allows an attacker who already holds elevated credentials to exploit concurrent shared-resource access in the DNS service, achieving full code execution (C:H/I:H/A:H) over the network. No public exploit or CISA KEV listing is identified at time of analysis, and Microsoft has released patches; the PR:H and AC:H constraints substantially limit realistic exploitation.

Concurrent access to an unprotected singleton context structure in Zephyr RTOS's UpdateHub OTA subsystem enables two independent callers - the background autohandler and user-triggered update operations - to race through prepare_fds(), producing an out-of-bounds write that corrupts adjacent struct members and disables the firmware-update path. Affected are embedded systems running Zephyr with the UpdateHub subsystem enabled, particularly those built with CONFIG_USERSPACE where unprivileged userspace threads can invoke update syscalls and actively compete with the workqueue handler. No public exploit has been identified at time of analysis, the CVSS base score is 2.5, and the vendor commit confirms no demonstrated path to code execution - impact is limited to availability of the OTA update mechanism.

Denial-of-service in the TP-Link Archer A6 v4 httpd service allows an adjacent, authenticated attacker to crash the web management process or force a device reboot by exploiting a race condition in the asynchronous systool instruction handling path. All firmware builds prior to V4_1.15.10 Build 260625 Rel.25447 are affected; a vendor-released patch has been issued. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog - real-world risk is constrained by the adjacent network and high-privilege prerequisites.

Race condition in NVIDIA Dynamo's LoRA manager singleton initialization exposes Linux-based AI inference deployments running versions up to v1.2.0 to data tampering and denial of service. The flaw, classified under CWE-362, arises during concurrent initialization of the singleton responsible for managing Low-Rank Adaptation (LoRA) adapters, allowing competing threads or network-triggered requests to corrupt shared state before synchronization is established. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector paired with no privilege requirement makes this relevant for any internet-facing or multi-tenant Dynamo deployment.

Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.

Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.

Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.

UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.

Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.

Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.

Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.

Information disclosure in macOS and tvOS due to a race condition allows a malicious local app to read sensitive user data without authorization. Affected versions include macOS prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6, and tvOS prior to 26.6. No active exploitation or public exploit code has been identified, and EPSS indicates very low exploitation probability.

iOS and iPadOS versions before 26.6 allow a malicious app to modify protected file system areas via a race condition. The vulnerability, tracked as CVE-2026-43811, requires local user interaction and has no known public exploit or active exploitation, with EPSS indicating very low real-world likelihood.

Sensitive information disclosure vulnerability in macOS via a race condition allows a local malicious application to access user data. Apple fixed the issue in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. No active exploitation or public proof-of-concept is known.

Null pointer dereference in the Linux kernel's cpufreq subsystem during system reboot allows a local attacker with low privileges to crash the kernel. The reboot path (kernel_restart() → device_shutdown() → cpufreq_suspend()) does not invoke freeze_processes() - unlike the normal suspend path - leaving CPU hotplug operations free to run concurrently and free governor_data while cpufreq_suspend() is still reading it, producing a use-after-free null pointer dereference. No public exploit exists and EPSS probability is 0.22% (13th percentile), placing this in low-urgency territory despite the ubiquitous kernel footprint.

KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.

Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.

Deleting an ovpn (OpenVPN data-channel-offload) netdevice while a concurrent netlink CMD_PEER_NEW request adds a fresh peer can leave the interface permanently hung and impossible to unregister in Linux kernel 6.16 and later. The flaw is a local, root-privilege-adjacent denial of service: an attacker who already holds CAP_NET_ADMIN (obtainable inside a user namespace) must repeatedly win a very narrow race between ovpn_dellink() teardown and the peer-add path, which re-takes a netdev reference after all peers were assumed freed. Impact is limited to availability of the affected ovpn device - there is no confidentiality or integrity effect and no remote vector - and EPSS is only 0.20% (10th percentile), with no public exploit identified at time of analysis and no CISA KEV listing. Vendor patches are available in stable releases 6.18.34, 7.0.11 and 7.1, and Ubuntu has issued USN-8593-1; the issue is rated LOW priority despite the valid CVSS 4.7 MEDIUM score.

The Linux kernel's lm90 hardware-monitoring driver can be driven into a use-after-free race during driver unbind or a failed probe, where the delayed alert_work or report_work item executes after devm cleanup has already unregistered and freed the hwmon device, producing a kernel oops with availability-only impact. Systems are affected only if they contain an LM90-family temperature sensor so the lm90 driver is actually probed and loaded, and triggering the bug requires local privileged access (root or CAP_SYS_ADMIN, in practice stronger than the stated PR:L) plus a narrow timing window, which is why the issue rates only CVSS 4.7 with an EPSS of 0.17% (6th percentile). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released patches are available in the stable kernel branches (6.18.34, 7.0.11, 7.1).

Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.

Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.

Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.

Race condition in IBM Cognos Analytics 12.1.3 (builds through 12.1.3-2606251736) allows authenticated users to obtain incorrect report summary results belonging to other users or trigger report-processing failures by exploiting improper synchronization in the Agentic AI assistant's concurrent request-handling logic. The flaw requires authenticated access and concurrent user activity, limiting opportunistic exploitation, though in high-concurrency enterprise deployments the race window may be reliably triggered. No public exploit code or active exploitation has been identified; a vendor patch is available.

Envoy Gateway's Wasm extension cache HTTP server (port 18002) can be crashed by a tenant-level attacker, causing a cross-tenant control-plane denial of service. The race condition in httpserver.go causes Go's runtime to call runtime.throw upon detecting an unsynchronized concurrent map access - a fatal signal that net/http's per-connection recover cannot intercept - terminating the entire controller process. While Kubernetes restarts the pod, all tenants sharing the controller lose control-plane availability during the restart window. No public exploit has been identified at time of analysis, but the four-condition precondition set is largely within baseline tenant capabilities.

Stale render context retention in ViewComponent::Base allows lower-privileged users to receive privileged UI from a prior admin render when component instances are reused across requests, tenants, or threads. Affected versions 4.0.0 through 4.11.x of the rubygems/view_component package fail to reset request-scoped instance variables between render_in calls, enabling cross-user authorization bypass, stale Host header injection into generated URLs, slot child context leakage, and cross-thread context corruption. A detailed publicly available proof-of-concept confirms all four impact vectors; no KEV listing is present, but the exploitability in realistic shared-registry patterns is directly demonstrated.