CVE-2026-82416 is a race condition vulnerability in FrankenPHP when running in worker mode with PHP's session extension loaded as a shared module rather than statically linked. This causes session IDs to leak between concurrent requests, leading to cross-user session exposure and session hijacking. The issue arises because session state reset code is compiled out when the session extension is shared, allowing stale session IDs to persist across requests. Builds with the session extension statically linked are not affected. The vulnerability results in users being intermittently logged out or served sessions belonging to other users.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a race condition due to improper synchronization when accessing the security policy. This flaw allows simultaneous reads and writes by multiple threads, leading to a heap buffer overwrite and potential application crash causing denial of service.
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
IBM Guardium Data Protection version 12.2 contains a race condition vulnerability in its patch installer that allows signature verification bypass. This flaw can be exploited by a local attacker to execute arbitrary code with root privileges, leading to full system compromise. The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). It has a high severity with a CVSS score of 7.8. No patch or official remediation information is currently provided. No known exploits are reported in the wild.
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.
Canimaan Software ClamXAV versions 3.3 through 3.11 contain a local privilege escalation vulnerability due to a race condition and insufficient file validation in the Privileged Helper Tool. This flaw allows a local attacker to execute arbitrary code with system privileges. The issue is fixed in version 3.11.1.
CVE-2026-104714 is a race condition vulnerability in Apache Struts affecting versions from 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The flaw occurs when localized messages format date or time arguments using a shared formatter without proper synchronization, leading to potential data leakage between users or server errors. Versions 6.12.0 and 7.4.0 include fixes for this issue.
Plane, an open-source project management tool, has a race condition vulnerability (CVE-2026-104970) affecting versions prior to 1.4.0. The flaw occurs in the InstanceAdminSignUpEndpoint where concurrent unauthenticated requests can bypass proper synchronization and create multiple instance administrators. This allows attackers to gain unrestricted instance administration privileges. The issue is fixed in version 1.4.0.
Wasmtime, a WebAssembly runtime, contains a vulnerability in its handling of bulk-data-transfer instructions like memory.copy when combined with preemption via epochs or fuel and store state mutations or computation cancellations. This can lead to exposure of intermediate internal states, causing semantic inconsistencies and potential segfaults. The issue affects embedders using Store::epoch_deadline_callback and performing store mutations or resuming computations after cancellation. Wasmtime versions 46.0.0 up to but not including 46.0.2 and 47.0.0 up to but not including 47.0.3 are affected. The vulnerability is fixed in versions 46.0.2 and 47.0.3 by reverting to a behavior that avoids preemption points during these operations.
CVE-2026-39601 is a race condition vulnerability in the WPdevelop Booking Calendar plugin affecting versions prior to 11.9. It involves improper synchronization during concurrent execution of shared resources, which can lead to integrity issues. The vulnerability has a low CVSS score of 3.7 and does not impact confidentiality or availability, only integrity to a limited extent.
CVE-2026-47565 is a race condition vulnerability in the NVIDIA GeForce GPU Display Driver for Linux kernel mode layer. It allows a privileged user to trigger an out-of-bounds write due to improper synchronization. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.4, indicating medium severity. No specific affected versions or patch information are provided.
CVE-2026-79625 is a race condition vulnerability in CODESYS Control RTE (SL) affecting versions >=3.0.0.0 <3.5.22.40 and >=3.5.0.0 <4.23.0.0. The issue arises from improper synchronization of monitoring functionality when multiple clients send concurrent requests. An authenticated remote attacker with monitoring access can exploit this to cause incorrect data processing or denial-of-service.
A race condition vulnerability (CWE-362) in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request due to improper synchronization of shared resources. This affects multiple versions of Apache Tomcat including 8.5.59 through 8.5.100, 9.0.39 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. The issue is fixed in versions 8.5.101 and later, 9.0.122 and later, 10.1.60 and later, and 11.0.26 and later. The vulnerability has a high severity with a CVSS score of 8.1.
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication.
The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other.
Once any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced.
This is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root.
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.