PT-2026-87476

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

PT-2026-87470

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

PT-2026-87789

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DNS allows an unauthorized attacker to deny service over a network...

CVE-2026-82755

ash_authentication_oauth2_server (ash-project, versions 0.1.3 through before 0.3.1) suffers from a cache-poisoning issue in its RFC 8414 / RFC 9728 metadata endpoints (AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter). When a tenant is derived from a header or Host value rather than the URL,...

CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

EEF-CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Summary Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...

EUVD-2026-72508

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

Security Bulletin: IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697.

Summary IBM Maximo Application Suite uses undici-7.28.0.tgz which is vulnerable to CVE-2026-13697. This bulletin contains information regarding the vulnerability and how it has been addressed. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed...

ROS-20260907-73-0043

The vulnerability in Erlang is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

ALPINE-CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99801 CVE-2026-18924 affecting package mysql 8.0.46-1

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99764 CVE-2026-18924 affecting package curl 8.11.1-11

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99834 CVE-2026-18924 affecting package rust 1.75.0-30

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99858 CVE-2026-18924 affecting package rust 1.90.0-10

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

AZL-99780 CVE-2026-18924 affecting package cmake 3.30.3-15

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

CVE-2026-18924

libcurl versions 7.44.0 through 8.21.x are affected by a use-after-free vulnerability in the handling of HTTP/2 Server Push streams. The flaw is triggered when the parent handle is configured to share connections with other handles, leading to a memory error during cleanup. The vulnerability was ...

CVE-2026-18924 HTTP/2 server push UAF

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...