4462 matches found
CVE-2026-16838 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...
CVE-2026-16838 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...
CVE-2026-16838
CVE-2026-16838 is a TOCTOU race condition in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 that allows a local attacker to overwrite critical files and obtain sensitive information. The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high complexity but f...
EUVD-2026-62727
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...
CVE-2026-72493
A flaw was found in the Linux kernel's networking subsystem. A race condition, specifically a Time-of-check to time-of-use TOCTOU vulnerability, exists during network device unregistration. This allows network packets to be processed after a device has been unregistered, leading to a use-after-fr...
CVE-2026-53613
When an /etc/fstab entry is configured with the user or users option, mount8 validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use TOCTOU window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that...
CVE-2026-53612
A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount8 changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this...
CVE-2026-73829
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
EEF-CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Summary Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic...
EUVD-2026-62591
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
CVE-2026-73829
ZenHive mpp (Elixir MPP library) versions 0.2.0 through 0.6.0 contain a TOCTOU race condition in the type="hash" credential path of MPP.Methods.Tempo.verify/2. The dedup check-then-mark sequence is non-atomic: check_hash_unused/2 reads the store, an on-chain receipt is verified, and only then doe...
CVE-2024-13942
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
CVE-2024-13942 Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
CVE-2024-13942 Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
EUVD-2024-55729
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
CVE-2024-13942
The RK3588s BootROM (secure) version 350B20210512V100 reads the next-stage loader header twice: a partial read (module hashes only) and a full read (with signature). Module authenticity is checked against the partial data, enabling a TOCTOU attack where an attacker swaps in a modified header on-t...