CWE-362 · Race Conditions
Race Condition
2,718CVEs
9exploited
0with a public check
39likely (EPSS 10%+)
SortMost likely exploited
2,718 CVEs with CWE-362 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-36884In CISA KEVExploitedWindows Search Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.5 · 2023-07-11 | 7.5 | 99% | 2023-07-11 |
| CVE-2016-5195In CISA KEVExploitedRace condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature…Linux · Kernel · CVSS 7 · 2016-11-10 | 7.0 | 84% | 2016-11-10 |
| CVE-2021-21166In CISA KEVExploitedData race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · CVSS 8.8 · 2021-03-09 | 8.8 | 24% | 2021-03-09 |
| CVE-2014-0196In CISA KEVExploitedThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local user…Linux · Kernel · CVSS 5.5 · 2014-05-07 | 5.5 | 20% | 2014-05-07 |
| CVE-2022-26904In CISA KEVExploitedWindows User Profile Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7 · 2022-04-15 | 7.0 | 17% | 2022-04-15 |
| CVE-2020-6820In CISA KEVExploitedUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnera…Mozilla · Thunderbird · CVSS 8.1 · 2020-04-24 | 8.1 | 7.1% | 2020-04-24 |
| CVE-2025-62215In CISA KEVExploitedWindows Kernel Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7 · 2025-11-11 | 7.0 | 4.5% | 2025-11-11 |
| CVE-2025-39964In CISA KEVExploitedcrypto: af_alg - Disallow concurrent writes in af_alg_sendmsgLinux · Linux · CVSS 7.8 · 2025-10-13 | 7.8 | 1.6% | 2025-10-13 |
| CVE-2021-25395In CISA KEVExploitedA race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.Samsung Mobile · Samsung Mobile Devices · CVSS 6.4 · 2021-06-11 | 6.4 | 0.4% | 2021-06-11 |
| CVE-2018-15473OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has b…Openbsd · Openssh · CVSS 5.9 · 2018-08-17 | 5.9 | 99% | 2018-08-17 |
| CVE-2014-0226Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obta…Apache · Http Server · 2014-07-20 | – | 86% | 2014-07-20 |
| CVE-2024-27983An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave s…NodeJS · Node · CVSS 8.2 · 2024-04-09 | 8.2 | 84% | 2024-04-09 |
| CVE-2022-46689A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS…Apple · macOS · CVSS 7 · 2022-12-15 | 7.0 | 48% | 2022-12-15 |
| CVE-2010-5298Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessi…Openssl · Openssl · 2014-04-14 | – | 34% | 2014-04-14 |
| CVE-2020-7457In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6…Freebsd · FreeBSD · 2020-07-09 | – | 33% | 2020-07-09 |
| CVE-2010-0017Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary co…Microsoft · Windows 7 · 2010-02-10 | – | 31% | 2010-02-10 |
| CVE-2021-25158A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8…Arubanetworks · Aruba Instant Access Points · 2021-03-30 | – | 30% | 2021-03-30 |
| CVE-2007-3091Race condition in Microsoft Internet Explorer 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 all…Microsoft · Internet Explorer · 2007-06-06 | – | 28% | 2007-06-06 |
| CVE-2007-0099Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or…Microsoft · Xml Core Services · 2007-01-08 | – | 26% | 2007-01-08 |
| CVE-2022-21881Windows Kernel Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7 · 2022-01-11 | 7.0 | 25% | 2022-01-11 |
| CVE-2010-0489Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corrupti…Microsoft · Internet Explorer · 2010-03-31 | – | 24% | 2010-03-31 |
| CVE-2006-2094Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify t…Microsoft · Internet Explorer · 2006-04-29 | – | 23% | 2006-04-29 |
| CVE-2010-3864Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow re…Openssl · Openssl · 2010-11-17 | – | 22% | 2010-11-17 |
| CVE-2010-2558Race condition in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to…Microsoft · Internet Explorer · 2010-08-11 | – | 21% | 2010-08-11 |
| CVE-2017-1000112Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. Ho…Linux · Linux Kernel · 2017-10-04 | – | 21% | 2017-10-04 |
| CVE-2018-8897A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-sy…Xen · Xen · 2018-05-08 | – | 18% | 2018-05-08 |
| CVE-2015-1791Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used…Openssl · Openssl · 2015-06-12 | – | 17% | 2015-06-12 |
| CVE-2012-3748Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via v…Apple · Safari · 2012-11-03 | – | 17% | 2012-11-03 |
| CVE-2019-6974In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.Linux · Linux Kernel · 2019-02-15 | – | 17% | 2019-02-15 |
| CVE-2019-0217In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate…Apache · Apache HTTP Server · 2019-04-08 | – | 16% | 2019-04-08 |
| CVE-2011-1257Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving…Microsoft · Internet Explorer · 2011-08-10 | – | 15% | 2011-08-10 |
| CVE-2024-28999SolarWinds Platform Race Condition VulnerabilitySolarWinds · SolarWinds Platform · CVSS 6.4 · 2024-06-04 | 6.4 | 14% | 2024-06-04 |
| CVE-2015-3196ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect dat…Openssl · Openssl · 2015-12-06 | – | 14% | 2015-12-06 |
| CVE-2019-8565A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges.Apple · iOS · 2019-12-18 | – | 14% | 2019-12-18 |
| CVE-2010-0021Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allow…Microsoft · Windows 7 · CVSS 5.9 · 2010-02-10 | 5.9 | 13% | 2010-02-10 |
| CVE-2015-8556Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.Qemu · Qemu · 2017-03-24 | – | 13% | 2017-03-24 |
| CVE-2016-4954The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed p…Ntp · Ntp · 2016-07-05 | – | 13% | 2016-07-05 |
| CVE-2014-3509Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used…Openssl · Openssl · 2014-08-13 | – | 13% | 2014-08-13 |
| CVE-2016-1757Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.Apple · Iphone Os · 2016-03-24 | – | 13% | 2016-03-24 |
| CVE-2018-4192An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on…Apple · Safari · 2018-06-08 | – | 12% | 2018-06-08 |
| CVE-2015-3081Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, A…Adobe · Flash Player · 2015-05-13 | – | 11% | 2015-05-13 |
| CVE-2017-0161The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold,…Microsoft Corporation · Windows NetBT Session Services · 2017-09-13 | – | 11% | 2017-09-13 |
| CVE-2018-8037If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a r…Apache Software Foundation · Apache Tomcat · 2018-08-02 | – | 11% | 2018-08-02 |
| CVE-2016-8655Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the C…Linux · Linux Kernel · 2016-12-08 | – | 11% | 2016-12-08 |
| CVE-2022-25090Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a r…Kofax · Printix · 2022-03-09 | – | 11% | 2022-03-09 |
| CVE-2017-2619Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the s…Samba · samba · 2018-03-12 | – | 11% | 2018-03-12 |
| CVE-2021-30465runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a…Linuxfoundation · Runc · 2021-05-27 | – | 10% | 2021-05-27 |
| CVE-2016-4309Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.Getsymphony · Symphony · 2016-06-30 | – | 10% | 2016-06-30 |
| CVE-2025-21376Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 8.1 · 2025-02-11 | 8.1 | 9.3% | 2025-02-11 |
| CVE-2016-4955ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoo…Ntp · Ntp · 2016-07-05 | – | 8.8% | 2016-07-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.