SUSE CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU in the mount program when setting up loop devices bsc1261606. CVE-2026-53613: Local Privilege Escalation via TOCTOU in mount8 — Target...

SUSE-SU-2026:4296-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2026-13595: heap use-after-free in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU in the mount program when setting up loop devices bsc1261606. - CVE-2026-53613: Local Privilege Escalation via TOCTOU in mount8 —...

CVE-2026-91813: Time-of-check Time-of-use (TOCTOU) Race Condition

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-61628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticat...

AlmaLinux 8 : tar (ALSA-2026:70390)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:70390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X'...

TencentOS Server 2: abrt (TSSA-2026:1063)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1063 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-86805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker t...

GHSA-XJ3H-WWXQ-GFCJ Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Summary Cloudreve v4 splits the storage-quota check reading the user's used bytes and comparing them to MaxStorage and the charge incrementing users.storage into two non-atomic steps in the PrepareUpload code path. This creates a Time-of-Check to Time-of-Use TOCTOU race condition. Any authenticat...

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Summary Cloudreve v4 splits the storage-quota check reading the user's used bytes and comparing them to MaxStorage and the charge incrementing users.storage into two non-atomic steps in the PrepareUpload code path. This creates a Time-of-Check to Time-of-Use TOCTOU race condition. Any authenticat...

Moderate: Red Hat Security Advisory: tar security, bug fix, and enhancement update

An update for tar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

CVE-2026-86805

A flaw was found in glibc, specifically within its dynamic loader ld.so. A local attacker can exploit a time-of-check to time-of-use TOCTOU race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DTRPATH for setuid/setgid programs,...

CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

DEBIAN-CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

AZL-103413 CVE-2026-86805 affecting package glibc 2.38-21

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...