Ability to bypass partner email confirmation to take over any store given an employee email Analysed #300305 Valid Shopify Race Conditions Critical 2018-02-07 $15,250 273 Race condition in performing retest allows duplicated payments Analysed #429026 Valid HackerOne Race Conditions Medium 2018-12-27 – 240 Race Condition leads to undeletable group member Analysed #604534 Valid HackerOne Race Conditions Low 2020-03-20 – 153 Race condition in activating email resulting in infinite amount of diamonds received #509629 No longer public InnoGames Race Conditions – – $2,000 137 Race Condition when following a user Analysed #927384 Valid Staging.every.org Race Conditions Low 2020-09-09 – 113 Race Condition Enables Bypassing Verification Check Analysed #2110030 Valid Tools for Humanity Race Conditions High 2024-04-04 $3,000 95 Race Condition in Flag Submission Analysed #454949 Valid HackerOne Race Conditions Low 2019-07-22 – 94 Race condition in joining CTF group Analysed #1540969 Valid HackerOne Race Conditions Low 2023-01-08 $500 72 Session works after logout from Shopify account Analysed #340191 Valid Shopify Race Conditions Low 2020-03-30 – 69 [pandao.ru] Возможность списания несуществующих бонусных баллов #484634 No longer public Mail.ru Race Conditions – 2019-03-05 – 58 Promotion code can be used more than redemption limit. Analysed #1717650 Valid Stripe Race Conditions Low 2023-02-13 – 55 Race condition in claiming program credentials Analysed #488985 Valid HackerOne Race Conditions Low 2019-05-19 – 54 Race condition leads to add more than 5 email at Data breaches monitor system at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net Analysed #1913309 Valid Mozilla Race Conditions Low 2024-10-18 – 50 Race Condition on Create API Function Analysed #2682392 Valid Enjin Race Conditions None 2024-10-15 – 45 Race condition while removing the love react in community files. Analysed #996141 Valid Figma Race Conditions Low 2020-10-10 $150 45 curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write #3747959 N/A curl Race Conditions Medium 2026-05-20 – 42 Race condition leads to Inflation of coins when bought via Google Play Store at endpoint https://oauth.reddit.com/api/v2/gold/android/verify_purchase Analysed #801743 Valid Reddit Race Conditions Medium 2021-10-27 – 42 MozillaVPN: Elevation of Privilege via a Race Condition Vulnerability Analysed #2261577 Valid Mozilla Race Conditions Medium 2025-07-03 – 41 Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`) #3752489 Informative Node.js Race Conditions High 2026-05-23 – 32 curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack #3955945 N/A curl Race Conditions Critical 2026-08-26 – 30 CVE-2023-32001: fopen race condition Analysed #2039870 Valid curl Race Conditions Medium 2023-07-25 – 26 Race condition on https://judge.me/people Analysed #1566017 Valid Judge.me Race Conditions Low 2022-08-01 $250 26 [api.krisp.ai] Race condition on /v2/seats endpoint allows bypassing the original seat limit Analysed #1418419 Valid Krisp Race Conditions Low 2022-04-04 – 26 CVE-2025-0665: eventfd double close Analysed #2954286 Valid curl Race Conditions Low 2025-02-07 – 24 libcurl cache updates follow symlinks and truncate their targets #3938220 N/A curl Race Conditions Low 2026-08-14 – 23 Data race in Curl_dnscache_add_negative() corrupts shared DNS cache — heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNS #3645361 Informative curl Race Conditions Medium 2026-04-04 – 23 [SFTP] TOCTOU Race Condition in Upload Resume Logic Leads to Arbitrary File Append #3432833 Informative curl Race Conditions Medium 2025-11-24 – 23 TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass #3335085 N/A curl Race Conditions High 2025-09-11 – 23 Race condition vulnerability on "This Rocks" button. Analysed #474021 Valid Rockstar Games Race Conditions Medium 2020-06-12 – 23 [curl] CVE-2023-32001: fopen race condition Analysed #2078571 Valid Internet Bug Bounty Race Conditions Medium 2023-07-27 $2,480 21 Race condition allows to send multiple times feedback for the hacker Analysed #1132171 Valid HackerOne Race Conditions Low 2021-09-22 – 18 Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl #3356088 Informative curl Race Conditions Medium 2025-09-26 – 17 Keep-alive socket process a response that was written before the request was sent Analysed #4038361 Valid Node.js Race Conditions Medium 2026-10-23 – 15 Bypass subdomain limits using race condition #395351 Valid Chaturbate Race Conditions Low 2018-09-27 $100 13 Race condition на покупке призов за баллы #700833 No longer public Mail.ru Race Conditions – 2020-02-18 – 12 node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely #3795900 Valid Node.js Race Conditions Medium 2026-08-28 – 11 HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent` #3582376 Valid Node.js Race Conditions Low 2026-06-25 – 11 No Rate On Add Suggest #481654 Valid Weblate Race Conditions Low 2019-01-22 – 11 Time-of-check to time-of-use vulnerability in the std::fs::remove_dir_all() function of the Rust standard library #1520931 Valid Internet Bug Bounty Race Conditions High 2022-03-24 $4,000 9 Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions #699112 No longer public Razer Race Conditions – – $250 8 CVE-2023-28320 - siglongjmp race condition #1990421 Valid Internet Bug Bounty Race Conditions Low 2023-05-26 $480 7 Race condition on my.stripo.email at /cabinet/stripeapi/v1/projects/298427/emails/folders uri #994051 Valid Stripo Inc Race Conditions Medium 2020-11-09 – 7 Bypass apiserver proxy filter #859962 Valid Kubernetes Race Conditions Medium 2021-05-27 – 7 CVE-2023-28320: siglongjmp race condition #1929597 Valid curl Race Conditions Low 2023-05-17 – 6 CVE-2026-87863: HSTS response erases persisted entries #3972373 Valid curl Race Conditions – 2026-10-14 – 3