CVE-2026-26074

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std::queue>` corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). This results in TSAN reports concurrent access (data race) to `event_queue`. Version 2026.2.0 contains a patch.

• CWE-362

• https://github.com/EVerest/EVerest/security/advisories/GHSA-p3hg-vqgv-h524Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26069Scraparr is a Prometheus Exporter for various components of …7.5
• CVE-2026-2607IBM MQ Operator SC2: v3.2.0 through 3.2.23CD:  v3.3.0, v3.4.…5.1
• CVE-2026-26070EVerest is an EV charging software stack. Versions prior to …4.2
• CVE-2026-26071EVerest is an EV charging software stack. Versions prior to …4.2
• CVE-2026-26072EVerest is an EV charging software stack. Versions prior to …4.2
• CVE-2026-26073EVerest is an EV charging software stack. Versions prior to …5.9
• CVE-2026-26075FastGPT is an AI Agent building platform. Due to the fact th…5.4
• CVE-2026-26076ntpd-rs is a full-featured implementation of the Network Tim…7.5
• CVE-2026-26077Discourse is an open source discussion platform. Prior to ve…6.5
• CVE-2026-26078Discourse is an open source discussion platform. Prior to ve…7.5
• CVE-2026-26079Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows…4.7
• CVE-2026-2608The Kadence Blocks — Page Builder Toolkit for Gutenberg Edit…4.3