Tag
N8n Git Node Race Condition Allows Authenticated RCE (CVE-2026-65598)
1 TTP 1 CVEA Time-of-Check to Time-of-Use (TOCTOU) race condition in n8n's Git node allows an authenticated user to achieve remote code execution (RCE) by swapping a directory with a symlink after path validation but before cloning, leading to the loading of a crafted malicious custom node upon server restart.
Race Condition in n8n Git Clone Node Leads to Remote Code Execution
3 TTPsA Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the Git node's clone operation in n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. This vulnerability allows authenticated users to bypass path restrictions by swapping a validated directory for a symlink, enabling them to plant a crafted repository in the community node directory. Upon the next restart, n8n loads this as a custom node, leading to arbitrary JavaScript execution on the server, affecting both self-hosted and cloud instances.
Gitea Repository Migration SSRF and Internal Git Repository Exfiltration
2 rules 9 TTPs 1 CVEA critical vulnerability in Gitea allows an authenticated, low-privileged user to exfiltrate internal Git repositories by exploiting a validation bypass, where Gitea's initial URL validation for repository migration is circumvented by the Git command-line client's default behavior of following HTTP redirects to otherwise blocked internal IP addresses, leading to server-side request forgery (SSRF) and the theft of sensitive code, credentials, and configuration into an attacker-controlled repository, with persistent exfiltration possible through pull mirrors.
SurrealDB RPC Endpoint Race Condition Allows Privilege Escalation (CVE-2026-63756)
2 TTPs 1 CVESurrealDB versions before 3.1.0 contain a time-of-check/time-of-use (TOCTOU) race condition in the HTTP /rpc endpoint that allows unauthenticated attackers to hijack authenticated session state and execute operations with elevated user privileges, leading to privilege escalation.
OpenClaw Race Condition Bypasses Authorization via DNS Rebinding Timing Window (CVE-2026-62212)
1 CVEA race condition exists in OpenClaw versions before 2026.5.28 within the MS Teams safeFetch DNS rebinding check, allowing a lower-trust caller to exploit a timing window between the DNS validation check and its use, potentially bypassing authorization or policy checks if the affected feature is enabled and reachable.
Hoverfly Process Crash via Concurrent Map Write Race Condition
1 TTPHoverfly, when running in Diff mode, is vulnerable to a denial-of-service condition due to a concurrent map write race condition in the `AddDiff()` function. Multiple proxy requests processed simultaneously cause unsynchronized writes to the shared `responsesDiff` map, triggering Go's built-in race detector and a `fatal error`, which immediately terminates the Hoverfly process. This vulnerability is trivially exploitable by sending multiple concurrent requests to the proxy port, leading to a full denial of service that cannot be recovered without a restart.
Windows Defender Race Condition (EDB-52612) Leads to Local Privilege Escalation and AV Bypass
1 TTP 3 IOCsA critical local race condition (EDB-52612) exists in Microsoft Windows Defender's MsMpEng.exe, specifically between its cleanup routine (`MpCleanCallbackFunction`) and Volume Shadow Copy creation, allowing Local Privilege Escalation (LPE) to NT AUTHORITY\SYSTEM and temporary disabling of antivirus protection through a use-after-free vulnerability, with a public exploit demonstrating the risk.
Gotenberg Denial-of-Service Vulnerability via Multipart downloadFrom Handling
2 rules 1 TTPGotenberg is vulnerable to a remote denial-of-service (DoS) in multipart `downloadFrom` handling, where a crafted multipart request with multiple `downloadFrom` entries causes concurrent goroutines to write to shared maps without synchronization, leading to process termination.
Open WebUI LDAP/OAuth Race Condition Allows Multiple Admin Accounts (CVE-2026-45675)
2 rules 1 TTPOpen WebUI versions 0.8.12 and earlier are vulnerable to a time-of-check-time-of-use (TOCTOU) race condition in the LDAP and OAuth authentication flows, allowing multiple concurrent requests on a fresh instance to bypass the first-user admin role assignment and resulting in multiple admin accounts (CVE-2026-45675).
CVE-2026-34351: Windows TCP/IP Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34351 is a race condition vulnerability in Windows TCP/IP that allows an authorized attacker to elevate privileges locally.
CVE-2026-34345 - Windows Ancillary Function Driver for WinSock Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34345 describes a race condition vulnerability in Windows Ancillary Function Driver for WinSock, allowing an authorized attacker to elevate privileges locally.
CVE-2026-34342 - Windows Print Spooler Components Privilege Escalation via Race Condition
2 rules 1 TTP 1 CVECVE-2026-34342 is a race condition vulnerability in Windows Print Spooler Components that allows an authorized attacker to elevate privileges locally.
CVE-2026-34334 Windows TCP/IP Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34334 describes a race condition vulnerability within Windows TCP/IP, enabling a locally authorized attacker to escalate privileges.
CVE-2026-34331: Windows Win32K - GRFX Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-34331 describes a race condition vulnerability in Windows Win32K - GRFX that allows an authorized attacker to elevate privileges locally due to improper synchronization when accessing shared resources.
CVE-2026-33839 - Windows Win32K GRFX Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-33839 is a race condition vulnerability in Windows Win32K - GRFX that allows an authorized local attacker to elevate privileges.
CVE-2026-32161 - Windows Native WiFi Miniport Driver Race Condition Vulnerability
2 rules 1 TTP 1 CVECVE-2026-32161 is a race condition vulnerability in the Windows Native WiFi Miniport Driver that allows an unauthorized attacker to execute code over an adjacent network.
CVE-2025-38717 KCM Race Condition Vulnerability
2 rules 1 CVECVE-2025-38717 is a race condition vulnerability in the kcm_unattach() function of a Microsoft product, potentially leading to denial of service or privilege escalation.
CVE-2025-68146 filelock TOCTOU Race Condition Enables Symlink Attacks
2 rules 1 CVECVE-2025-68146 describes a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the filelock library that could allow for symlink attacks during lock file creation, potentially leading to unauthorized file access or modification.
Windows User Interface Core Race Condition Privilege Escalation (CVE-2026-27911)
2 rules 1 TTP 1 CVECVE-2026-27911 is a race condition vulnerability in the Windows User Interface Core that allows a local attacker to elevate privileges due to improper synchronization when accessing shared resources.
Windows TCP/IP Race Condition Vulnerability (CVE-2026-33827)
2 rules 2 TTPs 1 CVECVE-2026-33827 is a race condition vulnerability in Windows TCP/IP that allows an attacker to execute arbitrary code over the network by exploiting improper synchronization during concurrent execution using shared resources.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-32160)
2 rules 1 TTP 1 CVECVE-2026-32160 describes a race condition vulnerability in Windows Push Notifications that allows a locally authorized attacker to elevate privileges.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-32158)
2 rules 1 TTP 1 CVECVE-2026-32158 is a race condition vulnerability in Windows Push Notifications that allows an authorized attacker to elevate privileges locally due to improper synchronization when using shared resources.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-26172)
2 rules 1 TTP 1 CVECVE-2026-26172 is a race condition vulnerability in Windows Push Notifications, allowing a locally authenticated attacker to elevate privileges.
Windows Projected File System Race Condition Privilege Escalation (CVE-2026-27927)
2 rules 1 TTP 1 CVECVE-2026-27927 is a race condition vulnerability in the Windows Projected File System that allows an authorized attacker to escalate privileges locally.
CVE-2026-27926 Windows Cloud Files Mini Filter Driver Privilege Escalation
3 rules 1 TTP 1 CVECVE-2026-27926 is a race condition vulnerability in the Windows Cloud Files Mini Filter Driver that allows a local attacker to elevate privileges.
Windows Push Notifications Race Condition Privilege Escalation (CVE-2026-32159)
2 rules 1 TTP 1 CVECVE-2026-32159 is a race condition vulnerability in Windows Push Notifications, allowing a local attacker with low privileges to elevate privileges by exploiting concurrent execution using a shared resource with improper synchronization.
Microsoft Brokering File System Race Condition Vulnerability (CVE-2026-32091)
2 rules 1 TTP 1 CVECVE-2026-32091 is a race condition vulnerability in the Microsoft Brokering File System, allowing an unauthenticated local attacker to escalate privileges.
Windows Shell Race Condition Vulnerability (CVE-2026-27918)
2 rules 1 TTP 1 CVECVE-2026-27918 is a race condition vulnerability in Windows Shell, allowing a local attacker to elevate privileges due to improper synchronization when accessing shared resources.
Lakeside SysTrack Agent Local Privilege Escalation via Race Condition (CVE-2026-35099)
2 rules 1 TTP 1 CVELakeside SysTrack Agent 11 before 11.2.1.28 is vulnerable to a race condition that allows for local privilege escalation to SYSTEM, as tracked by CVE-2026-35099.
Critical Vulnerabilities in NetScaler ADC and Gateway Allow Sensitive Data Exposure and Session Hijacking
2 rules 1 TTP 2 CVEsUnauthenticated attackers can exploit CVE-2026-3055 (out-of-bounds read) to exfiltrate sensitive data from NetScaler ADC and Gateway, while CVE-2026-4368 (race condition) enables user session hijacking, necessitating immediate patching and enhanced monitoring.
RegPwnBOF Registry Symlink Race Condition Exploit
2 rules 2 TTPsRegPwnBOF exploits a registry symlink race condition in the Windows Accessibility ATConfig mechanism, enabling a normal user to write arbitrary values to protected HKLM registry keys for persistence and privilege escalation.
Windows TCP/IP Race Condition Privilege Escalation (CVE-2026-27921)
2 rules 1 TTP 1 CVECVE-2026-27921 is a race condition vulnerability in Windows TCP/IP that allows a locally authenticated attacker to elevate privileges.
macOS Privilege Escalation via Feedback Assistant Race Condition (CVE-2019-8565)
2 rules 1 TTP 1 CVEA race condition vulnerability (CVE-2019-8565) exists in macOS where a privileged XPC service, com.apple.appleseed.fbahelperd, improperly validates XPC messages based on process ID, allowing an unprivileged process to escalate privileges to root.
CVE-2026-32150 Function Discovery Service Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32150 describes a race condition vulnerability in the Function Discovery Service (fdwsd.dll) that allows a locally authorized attacker to elevate privileges on a Windows system.
Mozilla Firefox WebRender Use-After-Free Vulnerability (CVE-2026-4684)
2 rules 1 TTPCVE-2026-4684 is a race condition and use-after-free vulnerability in the Graphics: WebRender component affecting Firefox versions less than 149, Firefox ESR versions less than 115.34 and 140.9, and Thunderbird versions less than 149 and 140.9, potentially leading to arbitrary code execution.
Ielixir-nodejs Cross-User Data Leakage Vulnerability
2 rules 1 TTPThe Ielixir-nodejs library before v3.1.4 is vulnerable to cross-user data leakage or information disclosure due to a race condition in the worker protocol, potentially exposing sensitive user data.
Oxia Server Crash via Session Heartbeat Race Condition
2 rules 1 TTPA race condition in Oxia's session heartbeat handling allows a remote client to trigger a denial-of-service by sending rapid KeepAlive requests during session expiration or closure, leading to a server crash.
nginx-ui Race Condition Leads to Data Corruption and Potential RCE
3 rules 2 TTPsThe nginx-ui application is vulnerable to a race condition due to concurrent requests corrupting the app.ini configuration file, potentially leading to a persistent denial of service and a non-deterministic path to remote code execution.
CVE-2026-32093 Function Discovery Service Race Condition Privilege Escalation
2 rules 1 TTP 1 CVEA race condition vulnerability in the Function Discovery Service (fdwsd.dll), tracked as CVE-2026-32093, allows a locally authorized attacker to escalate privileges on a vulnerable Windows system.
CVE-2026-32086 Function Discovery Service Race Condition Privilege Escalation
2 rules 1 TTP 1 CVECVE-2026-32086 is a race condition vulnerability in the Function Discovery Service (fdwsd.dll) that allows an authorized local attacker to elevate privileges on a Windows system.
OpenClaw Symlink Race Condition Allows Sandbox Escape
1 rule 1 TTPA time-of-check/time-of-use (TOCTOU) race condition in OpenClaw versions 2026.4.21 and earlier allows a symlink swap to redirect filesystem writes outside the intended sandbox mount root, potentially leading to arbitrary file modification.