Race Conditions

Every one of the 41 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obta…CVE-2014-0226Apache · 86% likely

   CWE-362

2. The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not…CVE-2019-10072Apache · 73% likely

   CWE-6671 bounty report

3. Apache Tomcat: RCE due to TOCTOU issue in JSP compilationCVE-2024-50379Apache Software Foundation · CVSS 9.8 · 32% likely

   CWE-3671 bounty report

4. mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a l…CVE-2002-1850Apache · 17% likely

   CWE-667

5. In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate…CVE-2019-0217Apache · 16% likely

   CWE-362

6. The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.1…CVE-2009-2699Apache · 14% likely

   CWE-667

7. Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new…CVE-2004-0174Apache · 12% likely

   CWE-667

8. If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a r…CVE-2018-8037Apache Software Foundation · 11% likely

   CWE-362

9. Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteCVE-2024-56337Apache Software Foundation · CVSS 9.8 · 9.0% likely

   CWE-367

10. Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to…CVE-2010-1151Apache · 3.8% likely

    CWE-362

11. Apache Tomcat: Information disclosureCVE-2021-43980Apache Software Foundation · CVSS 3.7 · 2.4% likely

    CWE-362

12. Apache Tomcat: APR/Native Connector crash leading to DoSCVE-2025-52434Apache Software Foundation · CVSS 7.5 · 2.1% likely

    CWE-362

13. CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticate…CVE-2018-8025Apache Software Foundation · 1.7% likely

    CWE-362

14. Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headersCVE-2026-119618Apache Software Foundation · CVSS 8.1 · 1.3% likelycovered by CyberSIXT

    CWE-3624 articles4 articles this week: Apache fixes HTTP/2 flaw that could enable remote code execution

15. A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes coul…CVE-2017-3158Apache Software Foundation · 1.2% likely

    CWE-362

16. Apache Answer: Repeated submission at registration created duplicate users with the same nameCVE-2024-26578Apache Software Foundation · CVSS 5.9 · 0.9% likely

    CWE-362

17. Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.CVE-2023-49619Apache Software Foundation · CVSS 3.1 · 0.9% likely

    CWE-362

18. Local privilege escalation with FileStoreCVE-2022-23181Apache Software Foundation · 0.7% likely

    CWE-367

19. Apache StreamPipes: Potential creation of multiple identical accountsCVE-2024-30471Apache Software Foundation · CVSS 5.3 · 0.7% likely

    CWE-367

20. Apache Struts: Shared message formatter exposes date and time values across concurrent requestsCVE-2026-104714Apache Software Foundation · CVSS 8.8 · 0.5% likelycovered by CyberSIXT

    CWE-3621 article

21. Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arb…CVE-2007-1741Apache · 0.5% likely

    CWE-362

22. Apache Tomcat: HTTP/2 request/response mix-up after error during async processingCVE-2026-101356Apache Software Foundation · CVSS 9.1 · 0.5% likelycovered by CyberSIXT

    CWE-3621 article

23. Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProviderCVE-2026-57818Apache Software Foundation · CVSS 8.1 · 0.5% likely

    CWE-367

24. Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled RequestCVE-2026-77762Apache Software Foundation · CVSS 8.1 · 0.5% likelycovered by CyberSIXT

    CWE-3621 article

25. Apache CloudStack: Domain/account resources limits not honoredCVE-2025-69233Apache Software Foundation · CVSS 6.5 · 0.4% likely

    CWE-367

26. Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature InstanceCVE-2026-85248Apache Software Foundation · CVSS 5.9 · 0.4% likely

    CWE-362

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.