CWE-362: Race Condition vulnerabilities

A race condition vulnerability (CWE-362) exists in patrickhener goshs versions prior to 2.1.0. The issue occurs in the ShareHandler where concurrent requests can bypass the intended download limit due to improper locking, allowing more downloads than configured. This flaw is fixed in version 2.1.0.

CVE-2026-64865 is a race condition vulnerability in QuantumNous new-api, an AI asset management system. Before version 1.0.0-rc.16, concurrent PUT requests to update user data could cause improper synchronization in quota management, allowing authenticated users to artificially maintain a higher cached quota. This issue is fixed in version 1.0.0-rc.16.

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests from multiple threads through the piControl character device.

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.

CVE-2026-73557 is a race condition vulnerability in the vllm-project's vllm software affecting versions from 0.20.2rc0 up to but not including 0.26.0. It arises from improper synchronization of a process-global sparse tensor invariant guard in PyTorch 2.11.0 during concurrent prompt-embedding reconstruction within a single chat completion request. This can lead to invalid sparse tensor deserialization and subsequent unsafe dense tensor conversion. The vulnerability requires the --enable-prompt-embeds feature (default off) but does not require multiple workers or multimodal embeddings. The flaw allows a malicious payload to bypass the follow-up guard, potentially causing memory corruption or denial of service as documented in the related CVE-2025-62164. The CVSS 4.0 base score is 6.3 (medium severity).

A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.

Use after free in Windows Work Folder Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.