CVE-2026-48024

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

CVE-2026-48024

Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 are affected by a path traversal in cluster synchronization. The function cluster.unmerge_info() constructs file paths from peer-controlled merge_type and name values, and process_files_from_worker() fails...

CVE-2026-74362

A flaw was found in the Linux kernel's ext2 filesystem. When performing write operations on files opened with OSYNC or ODSYNC flags, the system call write2 could incorrectly report success to a local user even if the data synchronization to disk failed. This could lead to data integrity issues, a...

CVE-2026-72313

A flaw was found in the Linux kernel's display rendering manager DRM framebuffer helper drm/fb-helper. This vulnerability arises from incorrect synchronization with display controllers CRTCs, where the system attempts to synchronize with an inactive controller. This can lead to display timeouts a...

ROS-20260818-73-0013

The vulnerability in Node.js is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-1199: Concurrent Execution using Shared Resource with Improper Synchronization

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...

CVE-2026-52733: Incomplete Cleanup

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/nonfinalizedstate/chain.rs, Chain::poptip removed a reverted tip block but did n...

CVE-2026-50139: Concurrent Execution using Shared Resource with Improper Synchronization

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

CVE-2026-74984: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74475

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. An issue exists where the neighbor hardware address MAC address could be read incorrectly due to a lack of proper synchronization. This could lead to the system using a partially updated or corrupted MAC address,...

The vulnerability in the fs/smb/client/cached_dir.h component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the fs/smb/client/cacheddir.h component in the Linux operating system is related to improper synchronization. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability in the driver/mfd/mfd-core.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/mfd/mfd-core.c component in the Linux operating system is related to the lack of synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100698)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100698 advisory. In the Linux kernel, the following vulnerability has been resolved: vrf: Fix a potential NPD when removing a port from a VRF RCU readers that identified a net device...

The vulnerability of the hns_roceHW_v2.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the hnsroceHWv2.c component in the Linux operating system is related to improper synchronization. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability in the driver/clocksource/sh_tmu.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drivers/clocksource/shtmu.c component in the Linux operating system is related to improper synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the driver/md/md-bitmap.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the drivers/md/md-bitmap.c component in the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the fs/proc/array.c component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the fs/proc/array.c component in the Linux operating system is related to the lack of synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the `drivers/net/usb/kaweth.c` component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/net/usb/kaweth.c component of the Linux operating system is related to the lack of synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-74512 audit: fix potential use-after-free in audit_del_rule()

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

CVE-2026-72094

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...