EUVD-2025-211096

A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...

CVE-2026-101308: Time-of-check Time-of-use (TOCTOU) Race Condition

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-57569: Time-of-check Time-of-use (TOCTOU) Race Condition

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2025-68404: Time-of-check Time-of-use (TOCTOU) Race Condition

A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...

SUSE SLES12: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4654-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4654-1 advisory. - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges bsc1282509. -...

GitLab 10.3 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-100104)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

CVE-2026-94621: Time-of-check Time-of-use (TOCTOU) Race Condition

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-130377)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130377 advisory. ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path policy...

SUSE SLES11: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / glibc-html / etc (SUSE-SU-2026:4669-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4669-1 advisory. This update for glibc fixes the following issue: - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate...

CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

FreeBSD : FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap (1fef3562-c848-11f1-ada3-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1fef3562-c848-11f1-ada3-bc241121aa0a advisory. When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not...

CVE-2026-102354

BentoPDF versions through 2.8.6 are vulnerable to a Server-Side Request Forgery (SSRF) via a Time-of-check Time-of-use (TOCTOU) race condition in the cloudflare/cors-proxy-worker.js component. The issue exists because hostnameResolvesToPrivate() performs a DNS-over-HTTPS safety check separately f...

CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

EUVD-2026-101421

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

CVE-2026-86562

A Time-of-Check to Time-of-Use (TOCTOU) double-fetch vulnerability exists in the DPDK lib/vhost component. Specifically, a double-fetch of control-queue descriptors in the VDUSE control-queue handler allows for a heap buffer overflow containing attacker-controlled content. This flaw is categorize...

CVE-2026-93683

A Time-of-check Time-of-use (TOCTOU) vulnerability exists in the DPDK vhost library when handling a virtio indirect descriptor table. The host reads the table length from guest memory multiple times, potentially allowing a guest to change the length between reads or provide an out-of-range next i...

CVE-2026-93683 Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

CVE-2026-93683 Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...