CVE-2026-101088: Time-of-check Time-of-use (TOCTOU) Race Condition

Nezha is a server and website monitoring tool. In versions = 2.2.11 and 2.3.1, the service sentinel worker service/singleton/servicesentinel.go contains an incomplete fix for a previously reported nil dereference denial of service GHSA-qjpp-gffx-2wm9. The 2026-07-21 fix re-validated the service...

CVE-2026-101041: Concurrent Execution using Shared Resource with Improper Synchronization

The account recovery password reset functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use TOCTOU race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then...

SUSE SLES16: lastlog2 / libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2026:23870-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23870-1 advisory. - CVE-2026-13595: heap use-after-free in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU in the mount progr...

CVE-2026-100713

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the SshKeys::generateFiles process. An attacker can gain unauthorized root access by atomically replacing...

rainbet-casino-exploit

CVE-2026-31337 — Seed Rotation TOCTOU Race Condition PoC !...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100713

Froxlor versions 2.3.10 and earlier are vulnerable to a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php ). The flaw exists because symlink validation occurs only at check time, while the filesystem path is re-resolved as r...

EUVD-2026-87686

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

stake-vulnerability

CVE-2025-31337 — Seed Rotation TOCTOU Race Condition PoC !...

CVE-2026-100597

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

PT-2026-99384

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description A time-of-check time-of-use TOCTOU race condition exists in the SSH key synchronization cron within the SshKeys::generateFiles function located in lib/Froxlor/Cron/System/SshKeys.php. TOCTOU is a...

CVE-2026-100713: Time-of-check Time-of-use (TOCTOU) Race Condition

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

PT-2026-99233

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description A time-of-check time-of-use TOCTOU race condition exists in OpenShell local mirror filesystem mutation operations. This occurs when the remove, mkdir, and rename operations act on a filesystem...

CVE-2026-100597: Time-of-check Time-of-use (TOCTOU) Race Condition

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

BIT-GITLAB-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

DEBIAN-CVE-2026-98130

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach between these operations, causing timerreduce to rearm the timer without...

CVE-2026-98130

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach between these operations, causing timerreduce to rearm the timer without...