CVE Watch20 jul 2026

CVE-2026-16211

A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increm

CVSS

2.6

Bajo

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 19 jul 2026 · Última mod.: 20 jul 2026 · CWE-362

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-192026-07-20

Descripción técnica

A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2022-250908.1 ALT

95.4%

——29Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition.12d CVE-2026-506677.8 ALT

80.2%

——24Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.5d CVE-2026-59477.5 ALT

69.2%

——21Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.6d CVE-2026-561889.8 CRÍ

58.9%

——18Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network.6d CVE-2024-352555.5 MED

52.2%

——16Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability8h CVE-2026-503698.8 ALT

47.2%

——14Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.9h