Astra Linux – Vulnerability in util-linux

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability was identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via...

Astra Linux – Vulnerability in Shadow

Shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

Astra Linux – Vulnerability in Linux 5.10

There is a vulnerability related to time-of-check to time-of-use issues in the iouringsubsystem’s IORINGOPCLOSE operation in the Linux kernel versions 5.6 to 5.11 inclusive. This vulnerability allows a local user to elevate their privileges to root. Introduced in the version...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: drm: A use-after-free issue in drmgetunique has been fixed. There is a time-of-check-to-time-of-use error in drmgetunique, caused by retrieving fpriv-master before locking the device’s master mutex. An example of this error can b...

CVE-2026-69779

Time-of-check time-of-use toctou race condition in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-86422: Improper Link Resolution Before File Access

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

CVE-2026-76925

A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy function. An attacker c...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-19118

A time-of-check time-of-use (TOCTOU) race condition in GitHub Enterprise Server enabled remote code execution . Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests . All versions prior to 3.22 were affected; fixes are avai...

CVE-2026-78422

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

UBUNTU-CVE-2026-65183

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 throug...

CVE-2026-56708: Time-of-check Time-of-use (TOCTOU) Race Condition

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

CVE-2026-9728

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-64846

Nix versions prior to 2.35.0 contain a TOCTOU race in the LocalStore restore path: writeFile opens a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing a malicious derivation (with recursive-nix enabled) to create or truncate an empty file outside the build sandbox with dae...

EUVD-2026-63424

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-64846 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-64846 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

PT-2026-79064

Name of the Vulnerable Software and Affected Versions Nix versions prior to 2.35.0 Description A time-of-check/time-of-use TOCTOU race condition exists in the LocalStore restore path when using the experimental recursive-nix feature. This occurs because the writeFile function may follow a...

CVE-2026-75856: Server-Side Request Forgery (SSRF)

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to intern...