CVE-2026-112907 is a low-severity vulnerability in the tox-dev filelock Python library affecting versions from 3.22.0 up to but not including 4.2.1. It involves improper locking behavior on Windows where a local user with read access to an unheld lock marker can cause certain soft lock operations to wait indefinitely beyond their timeout, effectively causing a denial of service. The issue does not compromise data confidentiality or integrity and does not allow access to files other than the lock marker. This flaw is fixed in version 4.2.1.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.
VoiceSentinel versions from 2.2.1 up to but not including 3.3.1 have a race condition in the optional report buffer feature. This race occurs between retention cleanup and transcript writes, leading to possible loss, duplication, or corruption of transcript data. The issue can also cause unbounded disk growth, potentially exhausting storage and crashing the host or other services. The feature is disabled by default and must be enabled to be affected. The vulnerability is fixed in version 3.3.1.
CVE-2026-110803 is an improper locking vulnerability in Vaadin Framework 8 where a session lock is not released if a non-numeric v-uiId request parameter causes an exception. This leads to thread pool exhaustion and application denial of service. The issue affects Vaadin Framework versions 8.16.0 through 8.32.1. Vaadin Framework 7 and versions 10 and later are not affected. A fix is available in version 8.32.2.
CVE-2026-111879 is a vulnerability in the Perl DBI module before version 1.656 where a failure during opening a DBD::DBM table causes the table's lock to remain held indefinitely. This improper locking occurs because a failed open_data call does not release the exclusive lock on the table's lock file, leading to subsequent attempts to open the table blocking indefinitely.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability in the Digital Certificate Manager (DCM) for System TLS related to improper locking (CWE-667). This flaw can be exploited by applications attempting to create secure network connections to cause a denial of service, potentially preventing a service from starting or forcing it to fallback to non-secure connections. The vulnerability has a CVSS score of 5.1, indicating medium severity.
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking. A successful exploit of this vulnerability might lead to denial of service.
Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain an improper locking vulnerability (CWE-667). This flaw could allow a low privileged remote attacker to gain unauthorized filesystem access. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. No official patch or remediation details are provided in the available data.
CVE-2026-45404 is a race condition vulnerability in the OpenTelemetry-Go library affecting versions from 0.11.0 up to but not including 1.45.0. The issue arises from an unsynchronized map used in the OpenTracing bridge's bridgeSpan, which can cause concurrent read/write operations leading to a runtime panic. This can terminate the process and cause a denial of service. The vulnerability is fixed in version 1.45.0.
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#release_read_lock also decrements the shared counter even when no read lock is held. Calling it on a fresh lock changes the counter from 0 to -1, after which normal read acquisition raises Concurrent::ResourceLimitError. This is a synchronization correctness issue in the public Concurrent::ReadWriteLock API. This vulnerability is fixed in 1.3.7.
CVE-2026-24182 is a medium severity vulnerability in NVIDIA GeForce display drivers for Windows and Linux. It involves improper locking that could allow an attacker to leak held driver locks. Exploitation of this flaw may result in a denial of service condition. The issue affects all driver versions prior to 595.71.05. No official patch or remediation guidance has been confirmed yet. There are no known exploits in the wild at this time.
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server.
This issue affects Command Centre Server:
9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior.
CVE-2026-21914 is a high-severity improper locking vulnerability in the GTP plugin of Juniper Networks Junos OS on SRX Series devices. An unauthenticated attacker can send a malformed GTP Modify Bearer Request message that causes a lock to be acquired and never released, leading to a watchdog timeout and FPC crash. This results in a denial-of-service condition causing complete traffic outage until the device recovers. The vulnerability affects multiple Junos OS versions prior to specific patched releases across versions 22.4R3-S8 through 25.2R2. Exploitation requires no authentication or user interaction and can be performed remotely over the network. There are no known exploits in the wild as of now. The CVSS v3.1 score is 7.
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. The USB event callback and user code share the hid_iface_t state without locking, so both can tear down a READY interface simultaneously, corrupting heap metadata inside the ESP USB host stack. This vulnerability is fixed in 1.1.0.
ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management. When an authenticated low-privilege user requests an administrative page, the application returns "404 Not Found" as expected, but incorrectly acquires and associates a temporary lock on the targeted resource with the attacker session prior to authorization. This lock prevents other users, including administrators, from accessing the affected functionality until the attacker navigates away or the session is terminated.
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.
This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.