CWE-362— Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.— MITRE CWE catalog
3,066 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-362page 20 of 62
- CVE-2020-8342HIGHCVSS 7.3EG 7.32020-09-15
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.
- CVE-2017-14798HIGHCVSS 7.3EG 7.32018-03-01
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
- CVE-2025-58316HIGHCVSS 5.5EG 7.32025-11-28
DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability.
- CVE-2023-47111HIGHCVSS 3.7EG 7.32023-11-08
ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password check attempts. On every failed password check, the amount of failed checks is …
- CVE-2026-51082HIGHCVSS 7.2EG 7.22026-07-17
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PV…
- CVE-2024-36262HIGHCVSS 7.2EG 7.22025-02-12
Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
- CVE-2020-25719HIGHCVSS 7.2EG 7.22022-02-18
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerbero…
- CVE-2015-6126HIGHCVSS v2 7.2EG 7.22015-12-09
Race condition in the Pragmatic General Multicast (PGM) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and…
- CVE-2014-5195HIGHCVSS v2 7.2EG 7.22014-08-07
Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock screen, which allows physically proximate attackers to bypass the lock screen by (1) leveraging a machine…
- CVE-2012-0426HIGHCVSS v2 7.2EG 7.22013-12-02
Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory.
- CVE-2013-4288HIGHCVSS v2 7.2EG 7.22013-10-03
Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_pr…
- CVE-2013-1279HIGHCVSS v2 7.2EG 7.22013-02-13
Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local user…
- CVE-2009-1894HIGHCVSS v2 7.2EG 7.22009-07-17
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /p…
- CVE-2009-1238HIGHCVSS v2 7.2EG 7.22009-04-02
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EX…
- CVE-2008-0055HIGHCVSS v2 7.2EG 7.22008-03-18
Foundation in Apple Mac OS X 10.4.11 creates world-writable directories while NSFileManager copies files recursively and only modifies the permissions afterward, which allows local users to modify copied files to cause a denial of service …
- CVE-2026-98118HIGHCVSS 7.1EG 7.12026-09-25
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the…
- CVE-2026-77633HIGHCVSS 7.1EG 7.12026-09-22
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional …
- CVE-2026-69364HIGHCVSS 7.1EG 7.12026-09-08
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
- CVE-2026-64496HIGHCVSS 7.1EG 7.12026-07-25
In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous fi…
- CVE-2026-64284HIGHCVSS 7.1EG 7.12026-07-25
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor spec…
- CVE-2026-53361HIGHCVSS 7.1EG 7.12026-07-04
In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: …
- CVE-2026-52988HIGHCVSS 7.1EG 7.12026-06-24
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase Publish new hooks in the list into the basechain/flowtable using splice_list_rcu() to ensure n…
- CVE-2022-26758HIGHCVSS 7.1EG 7.12026-06-10
A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4.
- CVE-2026-43042HIGHCVSS 7.1EG 7.12026-05-01
In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platform_label{,s} pair The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels v…
- CVE-2026-31486HIGHCVSS 7.1EG 7.12026-04-22
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_li…
- CVE-2026-33872HIGHCVSS 7.1EG 7.12026-03-27
elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Information Disclosure due to a race condition in the worker protocol. The lack of request…
- CVE-2026-31827HIGHCVSS 7.1EG 7.12026-03-10
Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a…
- CVE-2026-25536HIGHCVSS 7.1EG 7.12026-02-04
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multipl…
- CVE-2025-12472HIGHCVSS 7.1EG 7.12025-11-19
An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were foun…
- CVE-2025-64168HIGHCVSS 7.1EG 7.12025-10-31
Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to …
- CVE-2025-59052HIGHCVSS 7.1EG 7.12025-09-10
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side ren…
- CVE-2023-3758HIGHCVSS 7.1EG 7.12024-04-18
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
- CVE-2023-23407HIGHCVSS 7.1EG 7.12023-03-14
Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability
- CVE-2022-42930HIGHCVSS 7.1EG 7.12022-12-22
If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This vulnerability affects Firefox < 106.
- CVE-2022-3566HIGHCVSS 7.1EG 7.12022-10-17
A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity lev…
- CVE-2021-3752HIGHCVSS 7.1EG 7.12022-02-16
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their pr…
- CVE-2017-18018HIGHCVSS 7.1EG 7.12018-01-04
In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leve…
- CVE-2023-46132HIGHCVSS 6.5EG 7.12023-11-14
Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two …
- CVE-2025-66327HIGHCVSS 4.7EG 7.12025-12-08
Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- CVE-2024-29211HIGHCVSS 4.7EG 7.12024-11-13
A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files.
- CVE-2022-3567HIGHCVSS 4.6EG 7.12022-10-17
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommend…
- CVE-2015-8461HIGHCVSS v2 7.1EG 7.12015-12-16
Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via unspecified vectors.
- CVE-2015-7820HIGHCVSS v2 7.1EG 7.12015-11-12
Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provi…
- CVE-2015-7817HIGHCVSS v2 7.1EG 7.12015-11-12
Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provi…
- CVE-2015-4199HIGHCVSS v2 7.1EG 7.12015-06-27
Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering inter…
- CVE-2015-0654HIGHCVSS v2 7.1EG 7.12015-03-13
Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HT…
- CVE-2015-0631HIGHCVSS v2 7.1EG 7.12015-02-21
Race condition in the SSL implementation on Cisco Intrusion Prevention System (IPS) devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an …
- CVE-2015-0609HIGHCVSS v2 7.1EG 7.12015-02-16
Race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) …
- CVE-2015-0608HIGHCVSS v2 7.1EG 7.12015-02-12
Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers …
- CVE-2014-3406HIGHCVSS v2 7.1EG 7.12014-10-19
Race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule, …
Map vulnerabilities like CWE-362 to your infrastructure
EchelonGraph correlates every CVE — across CWE-362 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →