CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Backstage: Improper task state validation in Scaffolder backend

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)

multer vulnerable to file size limit bypass via async fileFilter race condition

vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Zoo Design Studio: Memory-corruption in memory handling of lib-kcl

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

hono/jsx does not isolate context per request, leading to cross-request data disclosure

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

NocoDB: OAuth Authorization Code Race Condition

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

ViewComponent: Reused Component Instances Retain Stale Render Context

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode