CVE-2025-15349 is a high-severity race condition vulnerability in the SCPI component of Anritsu ShockLine devices, allowing network-adjacent attackers to execute arbitrary code without authentication. The flaw arises from improper synchronization when accessing shared resources, enabling remote code execution in the context of the running process. Exploitation requires no user interaction but has a high attack complexity due to the need for precise timing. Although no known exploits are currently in the wild, the vulnerability impacts confidentiality, integrity, and availability. European organizations using Anritsu ShockLine for network testing and measurement could face significant operational and security risks. Mitigation involves applying vendor patches once available, restricting network access to the device, and monitoring for anomalous activity. Countries with advanced telecommunications infrastructure and heavy use of network testing equipment, such as Germany, France, and the UK, are most likely to be affected. Given the high CVSS score of 7.5, organizations should prioritize addressing this vulnerability promptly.
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
CVE-2026-23735 is a high-severity race condition vulnerability in graphql-hive's graphql-modules versions 2.2.1 to before 2.4.1 and 3.0.0 to before 3.1.1. The flaw occurs when multiple parallel requests trigger the same service, causing request contexts—often containing sensitive authentication tokens—to be mixed up due to improper synchronization in the @ExecutionContext() injection.
Multi-thread race condition vulnerability in the thermal management module.
Impact: Successful exploitation of this vulnerability may affect availability.
Multi-thread race condition vulnerability in the camera framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Multi-thread race condition vulnerability in the camera framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Multi-thread race condition vulnerability in the video framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
