EUVD-2026-111162

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...

EUVD-2026-111160

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic...

CVE-2026-13162

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

CVE-2026-13162

An OS command vulnerability exists in the CoreTec product within the configuration daemon's time synchronization handler , which manages system time-zone settings. The flaw occurs because the daemon constructs shell commands by concatenating user-supplied input without sufficient sanitization or ...

EUVD-2026-110815

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

CVE-2026-13162

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

CVE-2026-99051

A flaw was found in the Linux kernel's fsverity subsystem. A lack of proper synchronization when removing file verification structures allows concurrent lookup operations to access memory after it has been freed. A local user could exploit this vulnerability by triggering simultaneous file...

PT-2026-126390

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting th...

PT-2026-126646

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is...

PT-2026-126628

A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic...

ROS-20261027-73-0033

The vulnerability in tomcat-native is related to synchronization errors when using shared resources. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Redis < 7.2.14 / 7.4.x < 7.4.9 / 8.2.x < 8.2.6 / 8.4.x < 8.4.3 / 8.6.x < 8.6.3 / 8.8.x < 8.8-RC1 Multiple Vulnerabilities

The version of Redis installed on the remote host is prior to 7.2.14, or 7.4.x prior to 7.4.9, or 8.2.x prior to 8.2.6, or 8.4.x prior to 8.4.3, or 8.6.x prior to 8.6.3, or 8.8.x prior to 8.8-RC1. It is, therefore, affected by multiple vulnerabilities: - A use-after-free vulnerability exists in...

CVE-2026-111404

The VillaTheme Photo Reviews for WooCommerce plugin (wo-photo-reviews) is vulnerable to a Race Condition (CWE-362) due to concurrent execution using a shared resource with improper synchronization. This issue affects versions from n/a through 1.2.31 . Exploitation details are not provided in the ...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability in the Browser component of Google Chrome and Microsoft Edge is related to concurrent execution using a shared resource with improper synchronization. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted...

ROS-20261026-73-0073

The vulnerability in openssh is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-98794

A flaw was found in the Linux kernel's IPVS IP Virtual Server subsystem. An attacker on the local network can send synchronization messages containing invalid connection flag combinations to an IPVS backup server. This lack of validation can disrupt connection tracking lookups and corrupt...

CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

CVE-2026-93631 Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

CVE-2026-93631

A cross-site request forgery (CSRF) vulnerability exists in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition versions 10.1.16 and 10.1.20 . The flaw stems from the OAuth callback failing to bind its state value or authorization code to the initiating Zimbra session, instead...

CVE-2026-93631 Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...