CWE-362: Race Condition
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Also known as Concurrent Execution using Shared Resource with Improper Synchronization.
A kind of CWE-662 Improper Synchronization.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedA race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated cr…8.1 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server crash due to HPACK encoder race in net/http7.5 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities7.5 High
- ibm guardium data protectionIBM Guardium Data Protection Signature Verification Bypass7.8 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability5.3 Medium
- brocade fabric os, broadcom fabric operating system +1 moreA race condition and thread-safety vulnerability exists in the web management daemon of Brocade...2.1 Low
- brocade fabric os, broadcom fabric operating system +1 moreA race condition vulnerability exists in the request processing logic of the REST management...2.1 Low
- mispMISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests6.3 Medium
- obot-platform obotObot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership2.3 Low
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Improper task state validation in Scaffolder backend8.5 High
- google chromeRace condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...5.3 Medium
- google chromeRace condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...4.3 Medium
- google chromeRace condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute...8.8 High
- google chromeRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had...8.3 High
- google chromeRace condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...8.8 High
- google chromeRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...8.3 High
- google chromeRace condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had...8.3 High
- canimaan software clamxavCanimaan Software ClamXAV local privilege escalation7.3 High
- apache strutsApache Struts: Shared message formatter exposes date and time values across concurrent requests8.8 High
- makeplane planePlane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins8.1 High
- nezhahq nezhaNezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints6.0 Medium
- wpdevelop booking calendarWordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability3.7 Low
- akhilrex podgrabPodgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler8.7 High
- tryghost ghostGhost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token5.3 Medium
- mispMISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass7.6 High
- google androidIn handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due...7.0 High
- google androidIn ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could...7.0 High
- nvidia geforce, guest driver, rtx, quadro, nvs +1 more +3 moreNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a...6.4 Medium
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +15 more +17 moreImproper Synchronization in Monitoring in CODESYS Control Runtime7.2 High
- mozilla firefox, thunderbird +1 moreRace condition, use-after-free in the Audio/Video component7.5 High
- circl vulnerability-lookupVulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover6.3 Medium
- linux, linux kernel +1 morecgroup: Avoid iteration of dying tasks with zero refcount7.8 High
- openclawOpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript6.1 Medium
- google chromeRace condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote...5.3 Medium
- google chromechromedriver-154.0.8037.57-1.1 on GA media7.5 High
- linux, linux kernel +1 morenvme: fix racy access to FDP placement id array5.5 Medium
- linux, linux kernel +1 moreaccel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain5.5 Medium
- linux, linux kernel +1 moresctp: fix a TOCTOU race in SCTP_CMD_TIMER_START8.1 High
- linux, linux kernel +1 morenetfs: Fix readahead synchronisation issues by loading all folios upfront7.1 High
- linux, linux kernel +1 moreksmbd: safely drain sessions during logoff8.8 High
- linux, linux kernel +1 moreksmbd: fix listener task lifetime on netdev events7.8 High
- linux, linux kernel +1 moreBluetooth: hci_core: Fix race condition during device registration4.7 Medium
- linux, linux kernel +1 moreipv6: mcast: use rcu_assign_pointer() for __rcu list updates4.7 Medium
- linux, linux kernel +1 morebpf: Mark syscall helpers as sleepable5.5 Medium
- linux, linux kernel +1 moremlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context7.5 High
- gitlabConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab3.1 Low
- pollen robotics reachy miniReachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device6.3 Medium
- cloudreveCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service7.1 High
- apache software foundation tomcatApache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request8.1 High
- zephyrproject zephyrAEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization5.3 Medium
- Show moreLoading…