CVE-2026-68840

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69385

CVE-2026-69385 is a local elevation of privilege vulnerability in Windows TCP/IP caused by a race condition (improper synchronization of a shared resource during concurrent execution). An authorized attacker with low privileges can exploit this to gain higher privileges on the target system. The ...

EUVD-2026-73482

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

CVE-2026-69364

CVE-2026-69364 is an elevation of privilege vulnerability in Windows Print Spooler Components caused by a race condition (concurrent execution using a shared resource with improper synchronization). An authorized attacker (low privileges) can exploit it over a network to gain higher privileges, t...

EUVD-2026-73453

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Video Driver allows an authorized attacker to elevate privileges locally...

EUVD-2026-72974

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

EUVD-2026-73179

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

EUVD-2026-73172

Concurrent execution using shared resource with improper synchronization 'race condition' in DNS Server allows an unauthorized attacker to execute code over a network...

Windows USB Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows USB Driver allows an authorized attacker to elevate privileges locally...

Chromium: CVE-2026-84353 Use after free in Shared Tab Groups

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly...

valkey: Valkey: Remote code execution via use-after-free in stream deserialization

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If...

CVE-2026-82755

ash_authentication_oauth2_server (ash-project, versions 0.1.3 through before 0.3.1) suffers from a cache-poisoning issue in its RFC 8414 / RFC 9728 metadata endpoints (AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter). When a tenant is derived from a header or Host value rather than the URL,...

CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

EEF-CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Summary Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...

EUVD-2026-72508

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

Security Bulletin: IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697.

Summary IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697. This bulletin contains information regarding the vulnerability and how it has been addressed. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed...

ALPINE-CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...