4247 matches found
CVE-2026-79267: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-79196: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...
PT-2026-81327
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description A Server-Side Request Forgery SSRF issue exists due to a Time-of-Check to Time-of-Use TOCTOU flaw and a fail-open DNS validation mechanism. The JobSubmitRequest.validate webhook url function...
CVE-2026-79017: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. Chromium security severity: Low...
JetBrains TeamCity < 2021.2 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2021.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. CVE-2022-24332 - In JetBrains TeamCity before 2021.2, blind SSRF vi...
FreeBSD -- TOCTOU race in POSIX shared memory large page configuration
Problem Description: The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...
CVE-2026-9728
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
SUSE-SU-2026:23255-1 Security update for util-linux
This update for util-linux fixes the following issues: Security issues fixed: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues...
CVE-2026-9728
CVE-2026-9728 is a time-of-check/time-of-use (TOCTOU) race condition in the Zephyr RTOS userspace mailbox subsystem. The syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validates msg->data/msg->size by reading them directly from live userspace memory, then forwards the o...
CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
EUVD-2026-64897
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
CVE-2026-74692
A flaw was found in the Linux kernel's net/smc component. A time-of-check to time-of-use TOCTOU race condition allows a remote attacker to exploit a window where the listener's state is checked without proper locking. By opening TCP connections while the server is closing, an attacker can cause a...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Fixed a TOCTOU race condition in luosessionretrieve. The scope of the rwsemread lock in luosessionretrieve was extended to overlap with the acquisition of the session mutex. This prevents a concurrent thread from...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fixed the issue with TOCTOU in sofipc4bytesput. In sofipc4bytesput, the copy size is derived from the old data-size field in the buffer, rather than from the size field of the incoming new data from...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: ASoC: SOF: ipc3-control: Fixed the issue where TOCTOU was used in bytesput and bytesget. In sofipc3bytesput, the size used for the memcpy is derived from the old data-size that already exists in the buffer, rather than the siz...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fixed a divide-by-zero crash in the fan speed reading using TOCTOU. If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will cause a divide-by-zero crash due to a race...
PT-2026-80896
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A time-of-check/time-of-use TOCTOU race condition exists in the userspace syscall verifier z vrfy mbox send within drivers/mbox/mbox handlers.c. The verifier...
CVE-2026-9728: Time-of-check Time-of-use (TOCTOU) Race Condition
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...