CVE WatchJul 19, 2026

CVE-2026-16211

A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increm

CVSS

2.6

Low

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jul 19, 2026 · Last modified: Jul 19, 2026 · CWE-362

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2022-250908.1 HIG

95.4%

——29Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition.11d CVE-2026-506677.8 HIG

80.2%

——24Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.4d CVE-2026-59477.5 HIG

69.2%

——21Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.5d CVE-2026-561889.8 CRI

58.9%

——18Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.5d CVE-2026-503698.8 HIG

47.2%

——14Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.5d CVE-2026-566495.9 MED

47.1%

——14Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.3d