A race condition vulnerability in Apache Tomcat Native allows client certificate verification requirements to be downgraded under certain configurations. This affects versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15. The issue is fixed in versions 1.3.9 and 2.0.16. The vulnerability has a high severity rating with a CVSS score of 7.4.
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
Calling NSS-backed functions that support caching via nscd may call the
nscd client side code and in the GNU C Library version 2.36 under high
load on x86_64 systems, the client may call memcmp on inputs that are
concurrently modified by other processes or threads and crash.
The nscd client in the GNU C Library uses the memcmp function with
inputs that may be concurrently modified by another thread, potentially
resulting in spurious cache misses, which in itself is not a security
issue. However in the GNU C Library version 2.36 an optimized
implementation of memcmp was introduced for x86_64 which could crash
when invoked with such undefined behaviour, turning this into a
potential crash of the nscd client and the application that uses it.
This implementation was backported to the 2.35 branch, making the nscd
client in that branch vulnerable as well. Subsequently, the fix for
this issue was backported to all vulnerable branches in the GNU C
Library repository.
It is advised that distributions that may have cherry-picked the memcpy
SSE2 optimization in their copy of the GNU C Library, also apply the fix
to avoid the potential crash in the nscd client.
CVE-2026-23684 is a race condition vulnerability in SAP Commerce Cloud affecting versions HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21. The flaw allows an attacker to manipulate product entries in a shopping cart, potentially causing erroneous product values to be checked out. This vulnerability impacts data integrity but does not affect confidentiality or availability. Exploitation requires no privileges or user interaction but has a high attack complexity. No known exploits are currently in the wild. The CVSS score is 5.9, indicating a medium severity. European organizations using SAP Commerce Cloud for e-commerce operations could face financial discrepancies and transactional errors if exploited. Mitigation involves applying vendor patches once available, implementing strict concurrency controls, and monitoring transaction logs for anomalies. Countries with significant SAP Commerce Cloud deployments and strong e-commerce sectors, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
CVE-2026-22819 is a medium-severity race condition vulnerability in the open-source ngrok alternative 'outray' prior to version 0.1.5. It allows free plan users to obtain more subdomains than intended due to missing database transaction locking in the subdomain allocation code. The flaw impacts integrity and availability but does not affect confidentiality. Exploitation requires network access and low privileges but no user interaction. The vulnerability is fixed in version 0.1.5. There are no known exploits in the wild.
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
