Skip to content

CWE-667 · weakness in Race Conditions

Improper Locking

682 CVEs · 2 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
likely to be exploited
5

Every one of the 682 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, t…CVE-2021-1782Apple · CVSS 7 · 2.2% likely

    Apple

  2. A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, mac…CVE-2025-43510Apple · CVSS 7.8 · 0.4% likelycovered by CyberSIXT

    AppleAPT292 articles

  3. The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not…CVE-2019-10072Apache Tomcat · 73% likely
  4. mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a l…CVE-2002-185017% likely
  5. The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.1…CVE-2009-269914% likely
  6. Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new…CVE-2004-017412% likely
  7. A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via cr…CVE-2009-427211% likely
  8. Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response…CVE-2020-24606CVSS 8.6 · 4.6% likely
  9. The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS expor…CVE-2006-51583.7% likely
  10. Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot proces…CVE-2006-22753.6% likely
  11. An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.CVE-2020-132462.0% likely
  12. gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shu…CVE-2020-126581.8% likely
  13. The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users to cause a denial of service (…CVE-2006-23741.7% likely
  14. An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp…CVE-2019-155131.7% likely
  15. A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsoc…CVE-2021-267081.6% likely
  16. A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of…CVE-2021-20291containers/storage · 1.6% likely
  17. HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This v…CVE-2019-6321HP Z4 G4 Workstation (Xeon W) · 1.4% likely
  18. Missing release of locks in PJSIPCVE-2021-41141pjsip · CVSS 5.9 · 1.4% likely

    Pjsip

  19. Concurrent Versions Software (CVS) uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before i…CVE-2000-03381.4% likely
  20. An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolOb…CVE-2021-3667libvirt · 1.4% likely
  21. X.509 Policy Constraints Double LockingCVE-2022-3996OpenSSL · CVSS 7.5 · 1.3% likely

    OpenSSL

  22. HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM is disabled. This v…CVE-2019-6322HP Z4 G4 Workstation (Xeon W) · 1.2% likely
  23. The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEASE and 8.x before 8.0-RC1 unlocks a mutex that was not previously locked, which allows local users to cause a denial of…CVE-2010-42101.1% likely
  24. A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj ins…CVE-2022-0897libvirt · 1.0% likely
  25. An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists…CVE-2020-155291.0% likely
  26. A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watch…CVE-2019-8829Apple · 1.0% likely

    Apple

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in