CVE & Exploit Intelligence Database

CVE-2026-20918 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20877 7.8 HIGH EPSS 0.00

Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20874 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20873 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20869 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20867 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-415 Jan 13, 2026

CVE-2026-20866 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20861 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-415 Jan 13, 2026

CVE-2026-20858 7.8 HIGH EPSS 0.00

Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20853 7.4 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20848 7.5 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

CWE-362 Jan 13, 2026

CVE-2026-20844 7.4 HIGH EPSS 0.00

Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20836 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20830 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20826 7.8 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20815 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20814 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-20808 7.0 HIGH EPSS 0.00

Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally.

CWE-362 Jan 13, 2026

CVE-2026-22702 4.5 MEDIUM 1 Writeup EPSS 0.00

virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation operations. An attacker with local access can exploit a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. This issue has been patched in version 20.36.1.

CWE-59 Jan 10, 2026

CVE-2026-22701 5.3 MEDIUM 1 Writeup EPSS 0.00

filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.

CWE-59 Jan 10, 2026