Total
919 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-7837 | 2026-07-23 | N/A | 3.7 LOW | ||
| A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions. | |||||
| CVE-2026-42336 | 2026-07-23 | N/A | N/A | ||
| MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services. This vulnerability is fixed in 2.8.1. | |||||
| CVE-2026-53838 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 9.8 CRITICAL |
| OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions. | |||||
| CVE-2026-53831 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 8.3 HIGH |
| OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data. | |||||
| CVE-2026-53822 | 1 Openclaw | 1 Openclaw | 2026-07-23 | N/A | 8.8 HIGH |
| OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls. | |||||
| CVE-2026-49958 | 2026-07-23 | N/A | 5.0 MEDIUM | ||
| Hermes WebUI before version 0.51.303 contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the git_discard function within api/workspace_git.py that allows attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink after validation but before deletion. Attackers can substitute a workspace-controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation step and the subsequent Path.unlink() or shutil.rmtree() deletion call, causing the delete operation to follow the symlink and remove arbitrary files outside the workspace. | |||||
| CVE-2026-45487 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-07-23 | N/A | 7.8 HIGH |
| Time-of-check time-of-use (TOCTOU) race condition in Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-45647 | 1 Microsoft | 1 Defender For Endpoint | 2026-07-23 | N/A | 5.5 MEDIUM |
| Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-2638 | 2026-07-23 | N/A | N/A | ||
| A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption. | |||||
| CVE-2026-24065 | 2026-07-23 | N/A | 8.1 HIGH | ||
| Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2. | |||||
| CVE-2026-25260 | 1 Qualcomm | 70 Cologne, Cologne Firmware, Fastconnect 6700 and 67 more | 2026-07-22 | N/A | 7.8 HIGH |
| Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications. | |||||
| CVE-2025-64390 | 2026-07-22 | N/A | 7.4 HIGH | ||
| A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through a malformed JAR file. | |||||
| CVE-2026-35202 | 2026-07-22 | N/A | N/A | ||
| Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue. | |||||
| CVE-2025-41259 | 2026-07-22 | N/A | N/A | ||
| SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update. | |||||
| CVE-2025-59610 | 1 Qualcomm | 472 5g Fixed Wireless Access Platform, 5g Fixed Wireless Access Platform Firmware, C-v2x 9150 and 469 more | 2026-07-22 | N/A | 6.4 MEDIUM |
| Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer. | |||||
| CVE-2026-56648 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 7.5 HIGH |
| Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-20454 | 1 Mediatek | 72 Mt6739, Mt6739 Firmware, Mt6761 and 69 more | 2026-07-22 | N/A | 6.4 MEDIUM |
| In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786. | |||||
| CVE-2026-53518 | 1 Better-auth | 2 Better-auth\/oauth-provider, Better Auth | 2026-07-21 | N/A | 8.1 HIGH |
| Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11. | |||||
| CVE-2026-53517 | 1 Better-auth | 2 Better-auth\/oauth-provider, Better Auth | 2026-07-21 | N/A | 8.1 HIGH |
| Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refresh-token families; the vulnerable range also includes embedded better-auth plugin versions before 1.6.0. This issue is fixed in version 1.6.11. | |||||
| CVE-2026-45619 | 1 Wwbn | 1 Avideo | 2026-07-21 | N/A | 6.5 MEDIUM |
| WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU. | |||||