Base de CVEs

CVE-2025-64313 Média · 5.5 CWE-362 28/11/2025

Race Condition em Huawei Harmonyos

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-58316 Média · 5.5 CWE-362 28/11/2025

Race Condition em Huawei Harmonyos

DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-12472 Alta · 7.1 CWE-362 19/11/2025

Remote Code Execution in Looker due to Improperly Validated Directory Deletion

An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.103+ * 24.18.195+ * 25.0.72+ * 25.6.60+ * 25.8.42+ * 25.10.22+

CVE-2025-12383 Alta · 7.4 CWE-362 18/11/2025

Race Condition allows Bypass of Trust Restrictions

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

CVE-2024-7017 Alta · 7.5 CWE-362 14/11/2025

Race Condition em Google Chrome

Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2025-64345 Baixa · 1.8 CWE-362 12/11/2025

Wasmtime provides unsound API access to a WebAssembly shared linear memory

Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in parallel, and this could lead to a data race in the host. Patch releases have been issued for all supported versions of Wasmtime, notably: 24.0.5, 36.0.3, 37.0.3, and 38.0.4. These releases reject creation of shared memories via `Memory::new` and shared memories are now excluded from core dumps. As a workaround, eembeddings affected by this issue should use `SharedMemory::new` instead of `Memory::new` to create shared memories. Affected embeddings should also disable core dumps if they are unable to upgrade. Note that core dumps are disabled by default but the wasm threads proposal (and shared memory) is enabled by default.

CVE-2025-62218 Alta · 7.0 CWE-362 11/11/2025

Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally.

CVE-2025-62217 Alta · 7.0 CWE-362 11/11/2025

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2025-62215 Alta · 7.0 KEV Alta · 69 Exploit público CWE-362 11/11/2025

Microsoft Windows Race Condition Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2025-60723 Média · 6.3 CWE-362 11/11/2025

DirectX Graphics Kernel Denial of Service Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network.

CVE-2025-59508 Alta · 7.0 CWE-362 11/11/2025

Windows Speech Recognition Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

CVE-2025-59507 Alta · 7.0 CWE-362 11/11/2025

Windows Speech Runtime Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

CVE-2025-59506 Alta · 7.0 CWE-362 11/11/2025

DirectX Graphics Kernel Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally.

CVE-2025-64773 Baixa · 3.7 CWE-362 11/11/2025

In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit

CVE-2025-13012 Alta · 7.5 CWE-362 11/11/2025

Race condition in the Graphics component

Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

CVE-2025-12434 Média · 4.2 CWE-362 10/11/2025

Race Condition em Google Chrome

Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-12432 Alta · 8.8 CWE-362 10/11/2025

Race Condition em Google Chrome

Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-64683 Alta · 7.5 CWE-362 10/11/2025

Race Condition em Jetbrains Hub

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

CVE-2025-64682 Baixa · 3.7 CWE-362 10/11/2025

Race Condition em Jetbrains Hub

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

CVE-2025-64457 Alta · 7.0 CWE-362 10/11/2025

Race Condition em Jetbrains Dottrace

In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition

CVE-2025-43420 Média · 4.7 CWE-362 03/11/2025

A race condition was addressed with improved state handling. This issue is fixed in macOS Sonoma...

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.

CVE-2025-43364 Alta · 7.8 CWE-362 03/11/2025

A race condition was addressed with additional validation. This issue is fixed in macOS Sonoma 14...

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26.1. An app may be able to break out of its sandbox.

CVE-2025-64168 Alta · 7.1 CWE-362 31/10/2025

Agno session state overwrites between different sessions/users

Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2.

CVE-2025-64118 Média · 6.1 CWE-362 30/10/2025

node-tar vulnerable to race condition leading to uninitialized memory exposure

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

CVE-2025-40039 Média · 4.7 CWE-362 28/10/2025

ksmbd: Fix race condition in RPC handle list access

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup.