CVE-2026-126935
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file ma
CVSS
3.7
Low
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-367
Not enough EPSS history yet.
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit.
- github.comhttps://github.com/diced/zipline/blob/v4.7.0/src/server/routes/raw/%5Bid%5D.ts#L101-L133
- github.comhttps://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73
- github.comhttps://github.com/diced/zipline/releases/tag/v4.8.0
- github.comhttps://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578
- www.vulncheck.comhttps://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-126906——
———Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)2hCVE-2026-1115217.0 HIG—
———Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.3hCVE-2025-54506—2.8%
——1A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity.1dCVE-2026-500793.3 LOW0.2%
——0Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM.1dCVE-2026-882167.5 HIG41.2%
——12Time-of-check time-of-use (toctou) race condition in Windows DHCP Server allows an authorized attacker to execute code over a network.1dCVE-2026-1224745.9 MED45.9%
——14Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network.13h