CVE-2026-19506 RDK-B WebUI race condition vulnerability

Race condition in check.jst in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state...

CVE-2026-73541

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-72367

A flaw was found in the Linux kernel's iomap subsystem. This vulnerability occurs due to an integer underflow when calculating iosize during concurrent file truncation operations. If a file is truncated while writeback is in progress, the iosize can wrap to a large value, leading to incorrect...

CVE-2026-72353

A flaw was found in the Linux kernel's NTFS file system driver. A use-after-free vulnerability exists in the ntfsattrfallocate function, where a runlist element is accessed after its memory has been deallocated by a concurrent operation. A local attacker could exploit this to trigger a system...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

EUVD-2026-62593

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

Insecure Temporary File

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insecure Temporary File through the process that writes backup ZIP archives to a web-accessible location. An attacker can access sensitive files,...

CVE-2026-45742

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files,...

CVE-2026-45742 Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files,...

EUVD-2026-62425

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files,...

CVE-2026-45742 Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to concurrently write to the shared ctx.files,...

CVE-2026-45742

Gotenberg (a Docker-powered stateless PDF conversion API) versions 8.10.0 through 8.32.x contain a race condition in pkg/modules/api/context.go. The newContext function spawns one goroutine per multipart downloadFrom entry, and those goroutines concurrently write to shared maps (ctx.files, ctx.di...

CVE-2026-72340

A flaw was found in the Linux kernel's Microchip VCAP driver. A race condition exists in the shared Super VCAP block, where independent locking of VCAP instances can lead to concurrent access issues. A local attacker with the ability to trigger concurrent operations, such as a full rule dump in...

PT-2026-78820

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description A race condition exists when users upload models. An attacker with upload permissions can overwrite a model being uploaded by another user by sending a concurrent upload request using the...

PT-2026-78538

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings max gas, m...

SUSE CVE-2026-68137

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25listlock protects list membership while the lookup is in progress, but it...

EUVD-2026-60950

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-1199

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...