CVE-2026-58616

Concurrent execution using shared resource with improper synchronization 'race condition' in Copilot Chat Microsoft Edge allows an authorized attacker to disclose information over a network...

CVE-2026-82258

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

CVE-2026-82238

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

EUVD-2026-67584

SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests...

CVE-2026-82258

SvelteKit versions from 2.38.0 up to (but not including) 2.60.1 are affected by a race condition in the query.batch feature. Under specific timing conditions, concurrent requests from different users can merge under a single request context, allowing an attacker to access sensitive data from othe...

EUVD-2026-67690

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

CVE-2026-82238

filebrowser version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to bypass upload-length validation by sending multiple concurrent PATCH requests at the same offset. This results in files that exceed their declared Upload-Length and triggers completio...

CVE-2026-82238 filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation...

CVE-2026-80628

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q-lock sndseqossreadqclear resets qlen, head, and tail without q-lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset ca...

CVE-2026-80623

In the Linux kernel, the following vulnerability has been resolved: coresight: ete: Always save state on power down System register ETMs and ETE are unlikely to be preserved on CPU power down. The ETE DT binding also never documented "arm,coresight-loses-context-with-cpu" so nobody would have...

CVE-2026-80625

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

CVE-2026-80677

CVE-2026-80677 affects the Linux kernel driver core . The function dev_has_sync_state() reads dev->driver twice without holding device_lock()—once for a NULL check and once to dereference ->sync_state. Some callers hold only device_links_write_lock, which does not prevent a concurrent unbin...

CVE-2026-80677 driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()

In the Linux kernel, the following vulnerability has been resolved: driver core: use READONCE for dev-driver in devhassyncstate devhassyncstate reads dev-driver twice without holding devicelock -- once for the NULL check and once to dereference -syncstate. Some callers only hold...

CVE-2026-78103

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

EUVD-2026-67300

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread...

PT-2026-82977

In the Linux kernel, the following vulnerability has been resolved: driver core: use READ ONCE for dev-driver in dev has sync state dev has sync state reads dev-driver twice without holding device lock -- once for the NULL check and once to dereference -sync state. Some callers only hold device...

PT-2026-83369

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.4 and earlier Description The AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool within internal/context/context.go, using only the SUPI as a key. Requests processed by...

CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

CVE-2026-78103

WatchGuard Dimension (Log Server) is affected by a configuration lock bypass in its server-side configuration endpoint. The product provides a client-side lock/unlock UI control for management changes, but the server-side endpoint does not enforce this workflow state. As a result, an authenticate...

CVE-2026-59324

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...