3252 matches found
PT-2026-90311
In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...
PT-2026-90256
In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp lock before publishing proc entry create use gss proxy proc entry publishes /proc/net/rpc/use-gss-proxy via proc create data before init gssp clnt runs mutex init on sn-gssp lock. Once the dentry is linked under...
PT-2026-90405
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4 sequence can free the very slot it is currently processing. When the session shrinker has reduced se target maxslots below se fchannel.maxreqs, the shrink path checks thr...
PT-2026-90112
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc rx pipe buf release smc rx splice hands RMB pages to a pipe and takes a socket reference per entry so the smc sock stays alive until the reader finishes. The connection does not: a concurrent...
PT-2026-90251
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma rn unregister before rdma destroy id svc rdma free caches rdma-sc cm id-device before teardown, then calls rdma destroy idsc cm id which frees the cm id. rpcrdma rn unregister follows, but between those t...
PT-2026-90216
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu buffer::free page a buffer data read page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf order for the free pages call. This mismatched order may crashes the...
PT-2026-90007
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this...
PT-2026-90480
In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres release all calls Revocable::revoke via the release callback, whi...
EUVD-2026-75088
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...
CVE-2026-80914
CVE-2026-80914 is a use-after-free vulnerability in the Linux kernel's Bluetooth ISO subsystem , specifically in the iso_conn_ready() function. When a BIS listener socket is closed concurrently between iso_get_sock() and lock_sock(), the socket may be freed while a child socket remains linked to ...
CVE-2026-86766
Snipe-IT versions up to and including 8.6.3 contain a race condition TOCTOU in the consumable checkout API endpoint POST /api/v1/consumables/consumableid/checkout. The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction...
EUVD-2026-74921
Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...
CVE-2026-79962
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability. An unauthenticated attacker with remote access could potentially explo...
CVE-2026-87816
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...
EUVD-2026-74842
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...
CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...
CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...
CVE-2026-70582
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally...