Ubuntu kernel update includes MultiSound driver CVE-2017-9986
A local attacker could crash the system or possibly run code via a Turtle Beach audio driver race.
Stories per day · 30 days
3 RSS
Relatedwordpress9rce7wordfence6remote-code-execution3privilege-escalation2ubuntu2access-control1audio-driver1cisa-kev1core-update1double-free1freebsd1kernel1kev1linux-kernel1local-attack1stored-xss1sudoedit1
38 stories, newest first · one card per story
Stories tagged #race-condition
WordPress update race exposes sites to exploited CVE-2026-119977
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
unixODBC <=2.3.14 Multiple Races
Data races in connection-pooling state data and races between teardown and error-handling can cause double-frees and use-after-frees.
WordPress core RCE drew 60,471 attack attempts in 24 hours
Wordfence blocked the attempts after WordPress 7.1.4; the count does not show how many sites were compromised.
Attackers probe WordPress core race; 62,969 attempts in a day
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
1
Attackers target fresh WordPress core update flaw hours after patch
The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.
1
WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack
Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.
FreeBSD kernel TTY race condition allows local privilege escalation
CVE-2026-58093 is rated CVSS 7.8 and requires low-privileged code execution before exploitation.
WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE
Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.
1
Ubuntu 26.10 sudo-rs update fixes sudoedit race (USN-8708-2)
A local user allowed to sudoedit specific files could write files elsewhere and possibly gain higher privileges.
Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.
5
CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Apache Struts CVE-2026-104714 is a moderate race that can leak formatted dates across requests.
A Recycled File Descriptor: CVE-2026-103547 in OpenBSD's ldapd
OpenBSD ldapd CVE-2026-103547 let a remote client inherit another connection's LDAP Bind via a recycled file descriptor.
Docker CopyEscape CVE-2026-17106 Lets Malicious Containers Overwrite Host Files
Docker patches CopyEscape (CVE-2026-17106), which lets malicious containers overwrite host files during docker cp via a symlink race, potentially enabling root code execution.
12
CPython [CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
CVE-2026-12345 in CPython: race condition in tempfile.TemporaryDirectory cleanup can delete files outside the temporary directory.
CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded
Apache Tomcat Native CVE-2026-86247 can downgrade client-certificate checks via a race condition.
CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Apache Tomcat race lets a stale HPACK emitter inject trailers into another recycled request.
ZDI-26-742: Foxit PDF Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability
FoxitUpdater race condition CVE-2026-91813 lets a local low-privileged attacker escalate privileges on Foxit PDF Reader.
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) to its KEV catalog, federal patch deadline September 21, 2026.
ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-64265, a CVSS 7.8 race condition in the Linux Kernel FUSE subsystem enabling local privilege escalation.
ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability
ZDI discloses Linux Kernel Open vSwitch race condition (CVE-2026-74465) allowing low-privileged local attackers to escalate privileges, CVSS 7.8.
ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-74565, a CVSS 7.8 nftables race condition letting local low-privileged attackers escalate privileges on Linux.
ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability
ZDI discloses Linux Kernel SCTP subsystem race condition (CVE-2026-46227) allowing low-privileged local attackers to disclose sensitive information, CVSS 6.4.
ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability
ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.