CVE-2026-92583

AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters. An unauthenticated remote attacker can bypass all rate limits , including the documented 30-attempts-per-5-minutes login brute-force protection , by issuing con...

CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup

A flaw was found in the Moby container framework. A race condition occurs during the docker cp mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

CVE-2026-92615

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

SUSE CVE-2026-91708

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91712

Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91723

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-91743

Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91744

Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91748

Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

EUVD-2026-80802

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

CVE-2026-92615

flightctl 's configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify , a custom CA bundle, or tenant-supplied mTLS client certificates ) and installs it into go-git's process-global client.Protocols map via gitclient...

CVE-2026-92615 Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

CVE-2026-92615 Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed

A flaw was found in flightctl. The configureRepoHTTPSClient function in the device-render worker builds a per-repository tls.Config which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates and installs it into go-git's process-global client.Protocols m...

tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation

A flaw was found in Apache Tomcat. This vulnerability, caused by a race condition during concurrent execution, allows an attacker to inject unauthorized data, known as trailer fields, into another user's HTTP/2 request. This could lead to the manipulation of web traffic or unintended information...

tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation

A flaw was found in Apache Tomcat. This vulnerability, caused by a race condition during concurrent execution, allows an attacker to inject unauthorized data, known as trailer fields, into another user's HTTP/2 request. This could lead to the manipulation of web traffic or unintended information...

OPENSUSE-SU-2026:21864-1 Security update for mbedtls-2

This update for mbedtls-2 fixes the following issues: Changes in mbedtls-2: - CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs boo1245810 - CVE-2025-59438: padding oracle through timing of cipher error reporting boo1252454...