CVE-2026-116215

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is...

CVE-2026-116263

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

CVE-2026-116263 HaschekSolutions PictShare File Upload core.php architect race condition

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

CVE-2026-116263

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

EUVD-2026-109784

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

CVE-2026-116121

A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The...

CVE-2026-116119

A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub...

CVE-2026-116121

A race condition vulnerability exists in NocoDB (versions up to 2026.08.0 ) within the Registration component, specifically affecting the processing of the users.service.ts file. The vulnerability can be triggered remotely, though it is characterized by a high level of complexity and difficult ex...

EUVD-2026-109614

A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The...

python: python: Arbitrary file deletion via race condition during temporary directory cleanup

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...

Important: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-116119

A race condition vulnerability exists in NocoDB versions up to 2026.08.0 . The flaw is located within the Password-Reset Flow , specifically affecting an unknown part of the file packages/nocodb/src/services/users/users.service.ts. This vulnerability can be exploited remotely . No information reg...

EUVD-2026-109612

A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub...

CLSA-2026-1792979985 kernel: Fix of 154 CVEs

net: bridge: fix vlan tunnel dst refcnt when egressing CVE-2021-47222 - net: bridge: fix vlan tunnel dst null pointer dereference CVE-2021-47223 - writeback: fix race between cgroupwritebackumount and inodeswitchwbs CVE-2026-64378 - writeback, cgroup: increment iswnrinflight before grabbing an...

CVE-2026-80758

A flaw was found in the Linux kernel's futex subsystem. A race condition in the futexprivatehashput function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is dropped prematurely, enabling another process to free the memory while...

CVE-2026-80895

A flaw was found in the mshv component of the Linux kernel. A local user could exploit a race condition during the creation of a Virtual Processor VP and the assertion of an interrupt file descriptor irqfd. This could lead to the use of partially initialized VP fields, potentially causing system...

CVE-2026-80896

A flaw was found in the mshv component of the Linux kernel. A race condition exists in the mshvirqfddeassign function due to a missing lock, which can lead to concurrent operations on interrupt file descriptors irqfds. Additionally, the use of hlistdel instead of hlistdelinit can result in poison...

CVE-2023-37250-POC

CVE-2023-37250 PoC Write up: https://hackingiscool.pl/roaming-and-racing-to-get-system-cve-2023-37250/...

mach_race

Mach Race OS X Local Privilege Escalation Exploit c fG! 2015, 2016, [email protected] - https://reverse.put.as A SUID, SIP, and binary entitlements universal OS X exploit CVE-2016-1757. Usage against a SUID binary: ./machraceserver /bin/ps compatmode for i in seq 0 1000000; do...

CVE-2026-89983

A flaw was found in the Linux kernel's I2C subsystem. A race condition during adapter removal allows a local user to cause a Denial of Service DoS by crashing or hanging the system. When an I2C adapter is being deleted while a user concurrently creates a device through the sysfs interface, the...