Common Weakness Enumeration
CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
3595 vulnerabilities reference this CWE, most recent first.
CVE-2026-118128 (GCVE-0-2026-118128)
Vulnerability from cvelistv5 – Published: 2026-10-27 22:15 – Updated: 2026-10-28 16:12 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
Summary
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 15:54 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427455 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/427455/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118128 | third-party-advisory |
| https://vuldb.com/submit/1015057 | third-party-advisory |
| https://github.com/a2aproject/a2a-js/pull/636 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-js/commit/7b87c… | patch |
| https://github.com/a2aproject/a2a-js/releases/tag… | patch |
| https://github.com/a2aproject/a2a-js/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-js |
Affected:
1.0
Affected: 1.1.0 Unaffected: 1.2.0 cpe:2.3:a:a2aproject:a2a-js:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118128",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T15:54:30.660593Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:12:56.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-js:*:*:*:*:*:*:*:*"
],
"modules": [
"Task Status Update Handler"
],
"product": "a2a-js",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "unaffected",
"version": "1.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T22:15:19.102Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427455 | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/427455"
},
{
"name": "VDB-427455 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427455/cti"
},
{
"name": "CVE-2026-118128 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118128"
},
{
"name": "Submit #1015057 | a2aproject a2a-js \u2264 1.1.0 CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015057"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-js/pull/636"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-js/commit/7b87c9480bfa643f9d2b2eaf06988b3d3a95de25"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-js/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T17:51:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118128",
"datePublished": "2026-10-27T22:15:19.102Z",
"dateReserved": "2026-10-27T16:46:21.253Z",
"dateUpdated": "2026-10-28T16:12:56.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118030 (GCVE-0-2026-118030)
Vulnerability from cvelistv5 – Published: 2026-10-29 06:22 – Updated: 2026-10-29 14:18
VLAI
EPSS
VEX
Title
Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
Summary
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 14:18 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-118030 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2562005 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
Date Public
2026-10-26 13:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T14:18:28.734527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T14:18:44.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "keycloak-services",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Muhannad Alsaif (xNadByte) for reporting this issue."
}
],
"datePublic": "2026-10-26T13:54:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T06:22:11.871Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-118030"
},
{
"name": "RHBZ#2562005",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562005"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T13:54:35.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-26T13:54:35.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-118030",
"datePublished": "2026-10-29T06:22:11.871Z",
"dateReserved": "2026-10-27T14:17:43.932Z",
"dateUpdated": "2026-10-29T14:18:44.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117507 (GCVE-0-2026-117507)
Vulnerability from cvelistv5 – Published: 2026-10-27 15:00 – Updated: 2026-11-02 19:21 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-java TaskManager.saveTaskEvent race condition
Summary
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:20 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427074 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/427074/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-117507 | third-party-advisory |
| https://vuldb.com/submit/1015060 | third-party-advisory |
| https://github.com/a2aproject/a2a-java/pull/1045 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-java/commit/6b8… | patch |
| https://github.com/a2aproject/a2a-java/releases/t… | patch |
| https://github.com/a2aproject/a2a-java/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-java |
Affected:
1.2.0.Final
Unaffected: 1.3.0.Final cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:20:41.350153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:21:03.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*"
],
"product": "a2a-java",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "1.2.0.Final"
},
{
"status": "unaffected",
"version": "1.3.0.Final"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:00:21.118Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427074 | a2aproject a2a-java TaskManager.saveTaskEvent race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/427074"
},
{
"name": "VDB-427074 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427074/cti"
},
{
"name": "CVE-2026-117507 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-117507"
},
{
"name": "Submit #1015060 | a2aproject a2a-java \u2264 1.2.0.Final CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015060"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-java/pull/1045"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-java/commit/6b8e1e085c35e970ef0048901cd25850e4791ec2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-java/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T09:52:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-java TaskManager.saveTaskEvent race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-117507",
"datePublished": "2026-10-27T15:00:21.118Z",
"dateReserved": "2026-10-27T08:47:34.610Z",
"dateUpdated": "2026-11-02T19:21:03.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117499 (GCVE-0-2026-117499)
Vulnerability from cvelistv5 – Published: 2026-10-27 11:19 – Updated: 2026-10-27 11:19
VLAI
EPSS
VEX
Title
@fastify/session vulnerable to session revocation bypass via a logout race condition
Summary
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim's valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write.
Severity
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| @fastify/session | @fastify/session |
Affected:
0 , < 11.1.6
(semver)
Unaffected: 11.1.6 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/@fastify/session",
"product": "@fastify/session",
"vendor": "@fastify/session",
"versions": [
{
"lessThan": "11.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.1.6",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "koyokr"
},
{
"lang": "en",
"type": "reporter",
"value": "BlueN0r"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation developer",
"value": "UlisesGascon"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim\u0027s valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write."
}
],
"value": "@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker who already holds a victim\u0027s valid signed session cookie and keeps a request in flight across the logout can replay that cookie to restore the session after it was meant to be revoked, without any cookie theft or signature forgery. The issue is fixed in @fastify/session 11.1.6, which adds a per session generation marker and a conditional store write so a session restored before a logout or regeneration cannot recreate or overwrite the current entry, and users should upgrade to 11.1.6 or later. There is no workaround, and custom session stores must implement the new conditional write."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T11:19:22.090Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"url": "https://github.com/fastify/session/security/advisories/GHSA-2hw7-jxfh-4rm3"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "@fastify/session vulnerable to session revocation bypass via a logout race condition",
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-117499",
"datePublished": "2026-10-27T11:19:22.090Z",
"dateReserved": "2026-10-27T08:37:38.311Z",
"dateUpdated": "2026-10-27T11:19:22.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116476 (GCVE-0-2026-116476)
Vulnerability from cvelistv5 – Published: 2026-10-26 18:45 – Updated: 2026-11-02 18:03
VLAI
EPSS
VEX
Title
a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
Summary
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 18:02 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426389 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426389/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116476 | third-party-advisory |
| https://vuldb.com/submit/1014886 | third-party-advisory |
| https://github.com/a2aproject/a2a-dotnet/pull/453 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-dotnet/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-dotnet |
Affected:
1.0.0-preview3
cpe:2.3:a:a2aproject:a2a-dotnet:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T18:02:51.898526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T18:03:12.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-dotnet:*:*:*:*:*:*:*:*"
],
"modules": [
"TaskProjection"
],
"product": "a2a-dotnet",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "1.0.0-preview3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T18:45:20.493Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426389 | a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426389"
},
{
"name": "VDB-426389 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426389/cti"
},
{
"name": "CVE-2026-116476 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116476"
},
{
"name": "Submit #1014886 | a2aproject a2a-dotnet v1.0 CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014886"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-dotnet/pull/453"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-dotnet/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-26T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-26T12:04:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116476",
"datePublished": "2026-10-26T18:45:20.493Z",
"dateReserved": "2026-10-26T10:59:36.503Z",
"dateUpdated": "2026-11-02T18:03:12.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116403 (GCVE-0-2026-116403)
Vulnerability from cvelistv5 – Published: 2026-10-26 16:37 – Updated: 2026-10-26 17:37 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability
Summary
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 16:48 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Awesomemotive | Easy Digital Downloads |
Affected:
0 , ≤ 3.7.1
(custom)
|
Date Public
2026-10-26 16:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T16:48:29.516059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T17:37:10.367Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "easy-digital-downloads",
"product": "Easy Digital Downloads",
"vendor": "Awesomemotive",
"versions": [
{
"changes": [
{
"at": "3.7.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ananda Dhakal (Patchstack)"
}
],
"datePublic": "2026-10-26T16:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.\u003cp\u003eThis issue affects Easy Digital Downloads: from n/a through 3.7.1.\u003c/p\u003e"
}
],
"value": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Leveraging Race Conditions.This issue affects Easy Digital Downloads: from n/a through 3.7.1."
}
],
"impacts": [
{
"capecId": "CAPEC-26",
"descriptions": [
{
"lang": "en",
"value": "Leveraging Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:38:59.429Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-7-1-race-condition-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.7.2)."
}
],
"value": "Update the WordPress Easy Digital Downloads plugin to the latest available version (at least 3.7.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Easy Digital Downloads plugin \u003c= 3.7.1 - Race Condition vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-116403",
"datePublished": "2026-10-26T16:37:59.242Z",
"dateReserved": "2026-10-26T10:03:13.835Z",
"dateUpdated": "2026-10-26T17:37:10.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116263 (GCVE-0-2026-116263)
Vulnerability from cvelistv5 – Published: 2026-10-26 12:00 – Updated: 2026-10-31 01:16 X_Open Source
VLAI
EPSS
VEX
Title
HaschekSolutions PictShare File Upload core.php architect race condition
Summary
A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 01:15 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426302 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426302/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116263 | third-party-advisory |
| https://vuldb.com/submit/1010844 | third-party-advisory |
| https://xmit.xyz/security/the-file-that-changed-i… | exploit |
| https://github.com/HaschekSolutions/pictshare/com… | patch |
| https://github.com/HaschekSolutions/pictshare/rel… | patch |
| https://github.com/HaschekSolutions/pictshare/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HaschekSolutions | PictShare |
Affected:
3.7.0
Affected: 3.7.1 Unaffected: 3.7.2 cpe:2.3:a:hascheksolutions:pictshare:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116263",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T01:15:45.738975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T01:16:00.333Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hascheksolutions:pictshare:*:*:*:*:*:*:*:*"
],
"modules": [
"File Upload"
],
"product": "PictShare",
"vendor": "HaschekSolutions",
"versions": [
{
"status": "affected",
"version": "3.7.0"
},
{
"status": "affected",
"version": "3.7.1"
},
{
"status": "unaffected",
"version": "3.7.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is regarded as difficult. The exploit has been published and may be used. Upgrading to version 3.7.2 is sufficient to resolve this issue. Patch name: 6306e33da630c04ddff60703922c2ec7b7539452. It is advisable to upgrade the affected component. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.6,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T12:00:25.689Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426302 | HaschekSolutions PictShare File Upload core.php architect race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426302"
},
{
"name": "VDB-426302 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426302/cti"
},
{
"name": "CVE-2026-116263 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116263"
},
{
"name": "Submit #1010844 | HaschekSolutions PictShare 3.7.1 Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1010844"
},
{
"tags": [
"exploit"
],
"url": "https://xmit.xyz/security/the-file-that-changed-its-mind/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HaschekSolutions/pictshare/commit/6306e33da630c04ddff60703922c2ec7b7539452"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HaschekSolutions/pictshare/releases/tag/v3.7.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/HaschekSolutions/pictshare/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T19:00:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "HaschekSolutions PictShare File Upload core.php architect race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116263",
"datePublished": "2026-10-26T12:00:25.689Z",
"dateReserved": "2026-10-25T17:55:35.030Z",
"dateUpdated": "2026-10-31T01:16:00.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116215 (GCVE-0-2026-116215)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-31 01:20
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
Summary
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 01:20 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , ≤ 2026.1000.4056
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T01:20:20.915628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T01:20:31.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:47.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116215",
"datePublished": "2026-10-26T13:08:47.862Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-10-31T01:20:31.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116121 (GCVE-0-2026-116121)
Vulnerability from cvelistv5 – Published: 2026-10-26 05:15 – Updated: 2026-10-29 20:49
VLAI
EPSS
VEX
Title
NocoDB Registration users.service.ts race condition
Summary
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:49 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426189 | vdb-entry |
| https://vuldb.com/vuln/426189/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116121 | third-party-advisory |
| https://vuldb.com/submit/1004893 | third-party-advisory |
| https://github.com/nocodb/nocodb/issues/14686 | issue-tracking |
| https://github.com/nocodb/nocodb/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:49:24.285382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:49:36.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*"
],
"modules": [
"Registration"
],
"product": "NocoDB",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2026.08"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T05:15:16.078Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426189 | NocoDB Registration users.service.ts race condition",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426189"
},
{
"name": "VDB-426189 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426189/cti"
},
{
"name": "CVE-2026-116121 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116121"
},
{
"name": "Submit #1004893 | nocodb \u003c2026.08.1 Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004893"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nocodb/nocodb/issues/14686"
},
{
"tags": [
"product"
],
"url": "https://github.com/nocodb/nocodb/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T10:28:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "NocoDB Registration users.service.ts race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116121",
"datePublished": "2026-10-26T05:15:16.078Z",
"dateReserved": "2026-10-25T09:23:01.775Z",
"dateUpdated": "2026-10-29T20:49:36.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116119 (GCVE-0-2026-116119)
Vulnerability from cvelistv5 – Published: 2026-10-26 04:45 – Updated: 2026-11-02 17:53
VLAI
EPSS
VEX
Title
NocoDB Password-Reset Flow users.service.ts race condition
Summary
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:53 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426187 | vdb-entry |
| https://vuldb.com/vuln/426187/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116119 | third-party-advisory |
| https://vuldb.com/submit/1004891 | third-party-advisory |
| https://github.com/nocodb/nocodb/issues/14684 | issue-tracking |
| https://github.com/nocodb/nocodb/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:53:26.499659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:53:53.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*"
],
"modules": [
"Password-Reset Flow"
],
"product": "NocoDB",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2026.08"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T04:45:13.955Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426187 | NocoDB Password-Reset Flow users.service.ts race condition",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426187"
},
{
"name": "VDB-426187 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426187/cti"
},
{
"name": "CVE-2026-116119 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116119"
},
{
"name": "Submit #1004891 | nocodb \u003c 2026.08.1 Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004891"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/nocodb/nocodb/issues/14684"
},
{
"tags": [
"product"
],
"url": "https://github.com/nocodb/nocodb/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T10:28:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "NocoDB Password-Reset Flow users.service.ts race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116119",
"datePublished": "2026-10-26T04:45:13.955Z",
"dateReserved": "2026-10-25T09:22:54.099Z",
"dateUpdated": "2026-11-02T17:53:53.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
Architecture and Design
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Implementation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Implementation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.