Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,597

CVE-2026-2364

CODESYS Installer TOCTOU Privilege Escalation

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCTOU vulnerability in the CODESYS installer.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Codesys
Products
Codesys Installer
CVE-2026-5890

chromium-browser: Race in WebCodecs

Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-32282

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Internal/syscall/unix Go
CVE-2026-20831

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-20836

DirectX Graphics Kernel Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 15 more
CVE-2026-20919

Windows SMB Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 17 more
CVE-2026-20926

Windows SMB Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 17 more
CVE-2026-20830

Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows Server 2025
CVE-2026-20853

Windows WalletService Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 9 more
CVE-2026-20867

Windows Management Services Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 13 more
CVE-2026-25704

Incomplete privilege drop for com.system76.CosmicGreeter.GetUserData

A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in  cosmic-greeter can allow an attacker to regain privileges that should have been dropped and abuse them in the racy checking logic. This issue affects cosmic-greeter before https://github.Com/pop-os/cosmic-greeter/pull/426.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pop-os
Products
Cosmic-greeter
CVE-2026-27127

Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Craft Cms Craftcms
CVE-2026-3383

ChaiScript boxed_number.hpp go divide by zero

A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscript/dispatchkit/boxed_number.hpp. Executing a manipulation can lead to divide by zero. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Chaiscript
Products
Chaiscript
CVE-2026-31827

Alienbin: TTL Index Race Condition allows unauthorized deletion of other users data

Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL (e.g., 30 seconds), the TTL index is recreated with expireAfterSeconds: 30 for all documents in the collection. This causes User A's paste (originally set to 7 days) to be deleted after 30 seconds. An attacker can intentionally delete all existing pastes by repeatedly submitting pastes with ttlOption=30s.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Blue-b
Products
Alienbin
CVE-2026-20438

Out‑of‑Bounds Write in MediaTek MAE Enables Local Privilege Escalation

In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431920; Issue ID: MSV-5835.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google Mediatek
Products
Android Mt2718 Mt6899 and 9 more
CVE-2026-20445

Race Condition in MediaTek MDDP Leading to Local Denial of Service

In MDDP, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10289875; Issue ID: MSV-5184.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google Mediatek
Products
Android Mt6835 Mt6855 and 21 more
CVE-2026-28550

Race Condition in HarmonyOS Security Control Module Leading to Availability Impact

Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Harmonyos
CVE-2026-28543

Race Condition in HarmonyOS Diagnostics Module Causes Availability Issues

Race condition vulnerability in the maintenance and diagnostics module. Impact: Successful exploitation of this vulnerability may affect availability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Harmonyos
CVE-2026-28551

Race Condition in HarmonyOS Device Security Management Leads to Availability Impact

Race condition vulnerability in the device security management module. Impact: Successful exploitation of this vulnerability may affect availability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Harmonyos