CWE-362: Race Condition
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
719 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-17855 — Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the render
- CVE-2026-17711 — Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende
- CVE-2026-17709 — Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende
- CVE-2024-27102 — Improper isolation of server file access in github.com/pterodactyl/wings
- CVE-2026-17712 — Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a
- CVE-2026-78934 — Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineer
- CVE-2026-10940 — Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend
- CVE-2025-12383 — Race Condition allows Bypass of Trust Restrictions
- CVE-2026-87467 — Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially
- CVE-2026-32242 — Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
- CVE-2025-1127 — Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server
- CVE-2026-17654 — Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege es
- CVE-2025-66446 — MaxKB has a Python sandbox LD_PRELOAD bypass
- CVE-2025-66419 — MaxKB vulnerable to privilege escalation through sandbox bypass
- CVE-2025-25214 — A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev mast
- CVE-2026-87601 — Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside
- CVE-2026-7948 — Race in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform privilege esca
- CVE-2026-78915 — Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to poten
- CVE-2026-78906 — Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitra
- CVE-2026-78901 — Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside
Recently published
- CVE-2026-86766 — Snipe-IT 8.6.3 Race Condition via Consumable Checkout
- CVE-2026-86744 — snipe-it before 8.7.0 Race Condition in Asset Checkout
- CVE-2026-87816 — PasswordPusher before 2.11.1 Race Condition View Limit Bypass
- CVE-2026-87601 — Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside
- CVE-2026-87641 — Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access rest
- CVE-2026-87615 — Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeri
- CVE-2026-87467 — Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially
- CVE-2026-9040 — Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information
- CVE-2026-85704 — ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition
- CVE-2026-85639 — jofpin trape Telemetry Endpoint user.py race condition
- CVE-2026-14367 — I3C IBI work-node free-list data race between ISR and workqueue thread
- CVE-2026-82543 — vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition
- CVE-2026-82364 — macrozheng mall Order Submission submit race condition
- CVE-2026-55784 — free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI
- CVE-2026-77063 — multer vulnerable to file size limit bypass via async fileFilter race condition
- CVE-2026-82258 — SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
- CVE-2026-58093 — Kernel use-after-free via tty ioctls
- CVE-2026-78915 — Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to poten
- CVE-2026-78979 — Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social
- CVE-2026-78901 — Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside
More specific weaknesses
- CWE-1223 — Race Condition for Write-Once Attributes
- CWE-1298 — Hardware Logic Contains Race Conditions
- CWE-364 — Signal Handler Race Condition
- CWE-366 — Race Condition within a Thread
- CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
- CWE-368 — Context Switching Race Condition
- CWE-689 — Permission Race Condition During Resource Copy