4788 matches found
SNEK_Equinox
SNEK Equinox I would like to thank Nightmare-Eclipse for the inspiration not personal from the project UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Now funnily enough, I found a way to lie to the EDR web console to show that defender is up a...
CVE-2026-88968 Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an...
CVE-2026-88968
The Claude Code agentic coding tool (versions prior to 2.1.251 ) is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition in its Edit tool . The tool validates targets using pathname and symlink resolution that are not bound to the underlying directory inode or file descriptor. On mac...
dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...
dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...
dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...
dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...
util-linux security update
An update is available for util-linux. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The util-linux packages contain a large variety of low-level system...
RLSA-2026:93461 Important: util-linux security update
The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fixes: util-linux: TOCTOU in the mount program when setting up loop devices...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-18477 DESCRIPTION: A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a...
rbndr
rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...
CVE-2026-33825
🔵 CVE-2026-33825 — “BlueHammer” 🔵 Microsoft Defender Local Privilege Escalation LPE BlueHammer is a high-severity Local Privilege Escalation vulnerability affecting Microsoft Defender components on Windows systems. The flaw allows a low-privileged attacker to escalate privileges to NT...
CVE-2026-99239
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
DEBIAN-CVE-2026-99239
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
CVE-2026-99239
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
EUVD-2026-115281
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
CVE-2026-99239 Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
CVE-2026-99239
A TOCTOU race condition in the Linux kernel Bluetooth L2CAP component allows the l2cap_chan to be linked to l2cap_conn more than once, violating internal invariants. This occurs because l2cap_sock_connect() fails to check sk->sk_state, and l2cap_sock_bind() lacks sufficient locking for chan-&g...
CVE-2026-99239 Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
util-linux: TOCTOU in the mount program when setting up loop devices
A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the mount program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use TOCTOU window where an attacker can substitute th...