CVE-2026-13198 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

EUVD-2026-58673

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

EUVD-2026-57640

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent...

CVE-2026-7366

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent...

CVE-2026-7366

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent...

EUVD-2026-57067

The PSA Protected Storage credential backend subsys/net/lib/tlscredentials/tlscredentialstrusted.c declared its credential-store mutex as a plain zero-filled static struct kmutex credentiallock; and never called kmutexinit on it. A statically zero-filled kmutex has an uninitialized wait queue its...

PT-2026-71351

IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent...

AZL-95538 CVE-2026-73282 affecting package openssh for versions less than 9.8p1-10

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...

ALPINE-CVE-2026-73282

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...

CVE-2026-68146

A flaw was found in the Linux kernel's ftrace tracing subsystem. When a userspace program opens a trace file descriptor and shares it across multiple threads, concurrent write operations can lead to a race condition in the traceparser structure. This can result in corrupted input or undefined...

CVE-2026-18700

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

CVE-2026-73282

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...

CVE-2026-73282

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent...

CVE-2026-18700 Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

CVE-2026-18700

CVE-2026-18700 describes a use-after-free in MongoDB Server’s geospatial validation. An authenticated user with write privileges can trigger an internal reference to be used after memory is freed via concurrent operations against a collection using a specific validator, potentially crashing the s...

EUVD-2026-56913

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result ...

EUVD-2026-56593

Concurrent execution using shared resource with improper synchronization 'race condition' in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

Remote Desktop Client Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

Windows Telephony Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...

Windows Telephony Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...