CVE-2026-100546

OpenClaw npm package "openclaw" versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

EUVD-2026-87504

OpenClaw npm package openclaw versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

CVE-2026-100546 OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript

OpenClaw npm package openclaw versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

CVE-2026-100546 OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript

OpenClaw npm package openclaw versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

CVE-2026-100713: Time-of-check Time-of-use (TOCTOU) Race Condition

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

PT-2026-99384

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description A time-of-check time-of-use TOCTOU race condition exists in the SSH key synchronization cron within the SshKeys::generateFiles function located in lib/Froxlor/Cron/System/SshKeys.php. TOCTOU is a...

CVE-2026-98163: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

PT-2026-99257

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the cgroup subsystem when iterating through the dying tasks list. The issue occurs because the iterator may attempt to access tasks whose usage count has dropp...

PT-2026-99183

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.2 through 2026.9.1 Description A race condition exists in the Discord realtime voice transcript path. This occurs when concurrent control-classified voice transcripts consume speaker context from another participant...

CVE-2026-100546: Concurrent Execution using Shared Resource with Improper Synchronization

OpenClaw npm package openclaw versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

PT-2026-99233

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description A time-of-check time-of-use TOCTOU race condition exists in OpenShell local mirror filesystem mutation operations. This occurs when the remove, mkdir, and rename operations act on a filesystem...

CVE-2026-100597: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

SUSE CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

SUSE CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

SUSE CVE-2026-98153

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

AZL-105278 CVE-2026-93834 affecting package qemu 10.1.0-1

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

DEBIAN-CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

UBUNTU-CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...