CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

PT-2026-60558

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

The vulnerability of the tool for creating isolated virtual environments in Python’s virtualenv, related to synchronization errors when using a shared resource, allows a malicious actor to trigger a service failure.

The vulnerability of the tool for creating isolated virtual environments in Python virtualenv is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

Authorization Bypass Through User-Controlled Key

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the oauthcallback process. An attacker can access and modify anoth...

CVE-2026-50403

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an authorized attacker to elevate privileges locally...

CVE-2026-50321

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-50317

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Operating Systems allows an authorized attacker to elevate privileges locally...

Missing Synchronization

Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...

CVE-2026-54112

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Win32K allows an authorized attacker to elevate privileges locally...

EUVD-2026-44246

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Server Network driver allows an unauthorized attacker to execute code over a network...

CVE-2026-50384

CVE-2026-50384 describes a race condition in the Windows Clip Service caused by concurrent execution over a shared resource with improper synchronization. This vulnerability allows a locally authenticated attacker to elevate privileges. The CVSS 3.1 vector is LOCAL, with HIGH impact on confidenti...

CVE-2026-49808

The CVE-2026-49808 entry describes a race condition in the Windows kernel caused by concurrent execution on a shared resource with improper synchronization. An authorized local attacker can elevate privileges, as indicated by the description and CVSS vector (Local attack, High impact to confident...

CVE-2026-54999

The CVE-2026-54999 entry concerns a race condition in Windows TCP/IP where concurrent access to a shared resource allows an unauthorized attacker on an adjacent network to execute code. Documented impact is remote code execution with high severity (CVSSv3.1: AV=A, AC=L, PR=N, UI=N, S=U, C=H, I=H,...

CVE-2026-54996

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Print Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-52841

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns...

CVE-2026-52841

Easy!Appointments before 1.6.0 is vulnerable to an Authorization bypass in Google OAuth provider binding. The issue: in Google::oauth (application/controllers/Google.php:278), the provider_id supplied in the request is stored in the session and oauth_callback saves the Google OAuth token against ...

Windows Runtime Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Runtime allows an authorized attacker to elevate privileges locally...

Windows Clipboard Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Clipboard Server allows an authorized attacker to elevate privileges locally...

Microsoft Windows App Store Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows App Store allows an unauthorized attacker to elevate privileges over a network...

Windows Media Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Media allows an authorized attacker to elevate privileges over a network...