CWE-362: Race condition
3,025 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 12 of them as exploited in the wild.
- Published CVEs
- 3,025
- Last 12 months
- 994
- Critical
- 76
- Known exploited
- 12
Critical 76High 1,585Medium 1,219Low 144Not scored 1
CVEs per yearBy the year they were published
- 201548
- 201646
- 2017112
- 2018114
- 2019102
- 2020155
- 2021164
- 2022236
- 2023162
- 2024274
- 2025353
- 2026944
Known exploitedNewest addition to KEV first
- CVE-2025-39964
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Linux · Linux
ExploitedHigh7.8 - CVE-2025-62215
Windows Kernel Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.0 - CVE-2023-36884
Windows Search Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.5 - CVE-2021-25394
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is…
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium6.4 - CVE-2021-25395
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium6.4 - CVE-2014-0196
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case,…
Product not named
ExploitedMedium5.5 - CVE-2021-0920
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System…
Android
ExploitedMedium6.4 - CVE-2022-26904
Windows User Profile Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.0 - CVE-2016-5195
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a…
Product not named
ExploitedHigh7.0 - CVE-2021-21166
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Google · Chrome
ExploitedHigh8.8
Newest CVEs
- CVE-2026-17337
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High7.4 - CVE-2026-92694
FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts
pavel-odintsov · fastnetmon
Medium5.9 - CVE-2026-111770
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
modelcontextprotocol · typescript-sdk
High7.7 - CVE-2026-103112
Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
Red Hat · Red Hat build of Keycloak 26.4
High7.5 - CVE-2026-88814
YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition
Unknown · YITH WooCommerce Gift Cards
Low3.7 - CVE-2026-121963
FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close
FreeRDP · FreeRDP
High8.2 - CVE-2026-121961
FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
FreeRDP · FreeRDP
High8.2 - CVE-2026-121957
FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
FreeRDP · FreeRDP
High8.7 - CVE-2026-121230
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a…
Google · Chrome
High8.3 - CVE-2026-121079
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…
Google · Chrome
High8.8