Skip to content

CWE-366 · weakness in Race Conditions

Race Condition within a Thread

18 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 18 is a mark on the map. Named now: 1 to 18, most at risk first.

  1. Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary co…CVE-2021-26569Synology · CVSS 9.8 · 2.3% likely
  2. Kernel: gsm multiplexing race condition leads to privilege escalationCVE-2023-6546Red Hat · CVSS 7 · 0.7% likely
  3. Junos OS: A race condition vulnerability may cause RPD daemon to crash when processing a BGP NOTIFICATION message.CVE-2020-1629Juniper Networks · CVSS 5.9 · 0.7% likely
  4. XZ has a heap-use-after-free bug in threaded .xz decoderCVE-2025-31115tukaani-project · CVSS 8.7 · 0.7% likely
  5. oznetmaster SSharpSmartThreadPool SmartThreadPool.cs race conditionCVE-2015-10067oznetmaster · CVSS 4.6 · 0.6% likely
  6. Race Condition within a Thread in answerdev/answerCVE-2023-4127answerdev · CVSS 6.5 · 0.5% likely
  7. Race Condition within a Thread in it-novum/openitcockpitCVE-2023-3218it-novum · CVSS 6.5 · 0.5% likely
  8. Mutiple vulnerabilities in the Viridian interfaceCVE-2025-58143Xen · CVSS 9.8 · 0.4% likely
  9. ZCC race condition in ZPA tunnel handlerCVE-2026-25687Zscaler · CVSS 8.1 · 0.4% likely
  10. A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit pr…CVE-2022-1729linux kernel · 0.3% likely
  11. Race Condition Vulnerability in zenml-io/zenmlCVE-2024-2032zenml-io · CVSS 3.1 · 0.3% likely
  12. Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.tsCVE-2026-22819akinloluwami · CVSS 5.9 · 0.2% likely
  13. A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.CVE-2024-10630Ivanti · CVSS 7.8 · 0.2% likely
  14. Apache Tomcat Native: Client certificate requirements can be down-gradedCVE-2026-86247Apache Software Foundation · CVSS 7.4 · 0.2% likely
  15. Race condition vulnerability in SAP Commerce CloudCVE-2026-23684SAP_SE · CVSS 5.9 · 0.2% likely
  16. Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.hCVE-2023-4732Red Hat · CVSS 4.7 · 0.2% likely
  17. Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client m…CVE-2026-3904The GNU C Library · CVSS 6.2 · 0.2% likely
  18. RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()CVE-2026-46181Linux · CVSS 7.8 · 0.1% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in