Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-91947HIGHFreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCEPSS 0.4%CVE-2026-25674LOWPotential incorrect permissions on newly created file system objectsEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2023-6109MEDIUMYOP Poll <= 6.5.26 - Race Condition to Vote ManipulationEPSS 0.4%CVE-2022-48613—Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with tEPSS 0.4%CVE-2024-47870HIGHRace condition in update_root_in_config may redirect user traffic in GradioEPSS 0.4%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2025-58145HIGHArm issues with page refcountingEPSS 0.4%CVE-2021-3640—A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER EPSS 0.4%CVE-2026-64210HIGHnet/mlx5e: xsk: Fix unlocked writing to ICOSQEPSS 0.4%CVE-2021-3573—A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR orEPSS 0.4%CVE-2026-64025CRITICALbpf, skmsg: fix verdict sk_data_ready racing with ktls rxEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%CVE-2026-63756CRITICALSurrealDB before 3.1.0 Privilege Escalation via RPC Session Race ConditionEPSS 0.4%CVE-2026-111770HIGHModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherEPSS 0.4%CVE-2021-25395MEDIUMA race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilEPSS 0.4%KEVCVE-2024-39554HIGHJunos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crashEPSS 0.4%CVE-2010-5160MEDIUMRace condition in ESET Smart Security 4.2.35.3 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous cEPSS 0.4%CVE-2026-4684HIGHRace condition, use-after-free in the Graphics: WebRender componentEPSS 0.4%CVE-2021-4202—A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could EPSS 0.4%