CVE-2026-16212
Medium · 4.2CVSS
4.2
EPSS
0.3%
Published
Jul 19, 2026
CISA due date
—
The record
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. CWE-362
- CVE-2026-118030 A flaw was found in the HOTP authentication mechanism of the keycloak-services component… CWE-362
- CVE-2026-115402 OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a… CWE-362
- CVE-2026-118128 A vulnerability has been found in a2aproject a2a-js up to 1.1.0. CWE-362
- CVE-2026-117507 A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. CWE-362
- CVE-2026-117499 @fastify/session is a session plugin for Fastify. CWE-362
- CVE-2026-112708 A race condition was addressed with improved locking. CWE-362
- CVE-2026-113896 A race condition was addressed with additional validation. CWE-362