Total
2978 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-58316 | 1 Huawei | 1 Harmonyos | 2026-10-08 | N/A | 7.3 HIGH |
| DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-64118 | 2026-10-07 | N/A | N/A | ||
| node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2. | |||||
| CVE-2026-107276 | 2026-10-07 | N/A | N/A | ||
| MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: - The target MISP instance has email OTP login enabled. - The attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering). - The attacker can issue two HTTP POST requests in close temporal proximity. Impact: - The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. - This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48 | |||||
| CVE-2026-105140 | 2026-10-07 | N/A | 4.2 MEDIUM | ||
| Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes. | |||||
| CVE-2025-12432 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-10-07 | N/A | 8.8 HIGH |
| Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2025-12434 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-07 | N/A | 4.2 MEDIUM |
| Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2025-66328 | 1 Huawei | 1 Harmonyos | 2026-10-07 | N/A | 8.4 HIGH |
| Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-66446 | 1 Maxkb | 1 Maxkb | 2026-10-07 | N/A | 8.8 HIGH |
| MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0. | |||||
| CVE-2025-36934 | 1 Google | 1 Android | 2026-10-07 | N/A | 7.4 HIGH |
| In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-66327 | 1 Huawei | 1 Harmonyos | 2026-10-07 | N/A | 7.1 HIGH |
| Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2025-66320 | 1 Huawei | 1 Harmonyos | 2026-10-07 | N/A | 5.1 MEDIUM |
| Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-66321 | 1 Huawei | 1 Harmonyos | 2026-10-07 | N/A | 5.1 MEDIUM |
| Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-66326 | 1 Huawei | 1 Harmonyos | 2026-10-07 | N/A | 6.7 MEDIUM |
| Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-48625 | 1 Google | 1 Android | 2026-10-07 | N/A | 7.0 HIGH |
| In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-48564 | 1 Google | 1 Android | 2026-10-07 | N/A | 7.0 HIGH |
| In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-66419 | 1 Maxkb | 1 Maxkb | 2026-10-07 | N/A | 8.8 HIGH |
| MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0. | |||||
| CVE-2025-66322 | 1 Huawei | 1 Harmonyos | 2026-10-07 | N/A | 5.1 MEDIUM |
| Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2025-36916 | 1 Google | 1 Android | 2026-10-07 | N/A | 7.0 HIGH |
| In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-13231 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch. | |||||
| CVE-2026-58880 | 1 Google | 1 Android | 2026-10-07 | N/A | 7.0 HIGH |
| In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||