PT-2026-113430

Time-of-check time-of-use toctou race condition in Linux Kernel allows an authorized attacker to elevate privileges locally...

PT-2026-113211

Time-of-check time-of-use toctou race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally...

PT-2026-112699

Name of the Vulnerable Software and Affected Versions Windows Projected File System affected versions not specified Description A time-of-check time-of-use toctou race condition exists in the Windows Projected File System. This flaw allows an authorized attacker to perform local tampering. A TOCT...

CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation

CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation This repository contains a Proof of Concept PoC for CVE-2025-6019, a Race Condition vulnerability in udisks2 that allows local privilege escalation via XFS filesystem resizing. 🎯 Target Environments & Compatibility This exploit is...

CVE-2026-51385

CVE-2026-51385 Advisory for CVE-2026-51385. Needed to publish it as GRAPHIFY hasnt recognized the advisory neither publish it, and MITRE assigned CVE-2026-51385, this is the advisory for it. ES: Este fue mi primer cve, para ser honesto encontre una manera de romper la logica en la funcion ANTI...

CVE-2026-41651

🔥 CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation Pack2TheRoot Local Privilege Escalation exploit targeting the PackageKit daemon. Escalates from an unprivileged local user to root through a TOCTOU race condition vulnerability. 📌 Overview CVE-2026-41651 also known as Pack2TheRoot is...

CVE-2026-108361

The Privasys Remote Attestation TLS Clients (specifically Privasys/ra-tls-clients ) is vulnerable to a Time-of-Check Time-of-Use (TOCTOU) race condition in versions before 0.9.1 . An attacker with local access can modify workload code, data, and configuration at runtime after a successful connect...

CVE-2026-108361 Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

CVE-2026-33825

🔵 CVE-2026-33825 — “BlueHammer” 🔵 Microsoft Defender Local Privilege Escalation LPE BlueHammer is a high-severity Local Privilege Escalation vulnerability affecting Microsoft Defender components on Windows systems. The flaw allows a low-privileged attacker to escalate privileges to NT...

CVE-2026-109274

A flaw was found in ImageMagick. This vulnerability allows information disclosure by enabling a local attacker to bypass path security policies during the execution of a magick script. By exploiting a Time-of-Check to Time-of-Use TOCTOU race condition, an attacker can replace a validated file pat...

CVE-2026-109274 ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is...

CVE-2019-8561

CVE-2019-8561 Proof of concept exploit for CVE-2019-8561 discovered by Jaron Bradley @jbradley89 Patched in macOS 10.14.4. This script exploits a TOCTOU bug in installer which enables code execution as root. See Jaron's Objective By the Sea v2 talk "Bad Things in Small Packages" where he...

PlEXcalaison

Local Privilege PlEXcalasion - CVE-2021-42835 Plex Media Server for Windows prior to version 1.25.0.5282, vulnerable to Time Of Check Time Of Use TOCTOU that allows low privilege users to gain SYSTEM privileges. Discovered by Tomer Peled, Netanel Cohen, and Amir Shen a Security Researchers from...

CVE-2026-41651-Python

Pack2TheRoot: CVE-2026-41651 Python Python PoC of the PackageKit TOCTOU Local Privilege Escalation exploit. Any local unprivileged user can install arbitrary packages as root with no authentication. Field| Value ---|--- CVE| CVE-2026-41651 Component| PackageKit daemon packagekitd Affected version...

CVE-2025-31133

CVE-2025-31133 PoC Exploit This document explains the functionality of the provided Proof-of-Concept PoC script for the runc vulnerability CVE-2025-31133. Summary Vulnerability: CVE-2025-31133 - A symbolic link race condition in runc's maskedPaths handling. Impact: A malicious container can bypas...

sudo_digest_toctou_poc_CVE-2015-8239

sudoers DigestSpec TOCTOU POC Rationale Alyssa Milburn https://twitter.com/noopwafel discovered a TOCTOU race condition bug in sudo when the DigestSpec setting is used. The DigestSpec setting can be used to allow a user to sudo a binary if and only if its hash matches a prescribed value. See man...

CVE-2026-108981

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

CVE-2026-108981

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

CVE-2026-108981

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

EulerOS 2.0 SP13 : gzip (EulerOS-SA-2026-4052)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...