EventLogin-CVE-2025-29969

EventLogin - CVE-2025-29969 EventLogin is a Time-of-check time-of-use vulnerability in the MS-EVEN protocol. The vulnerability enables low-privileged users to write arbitrary files to a remote machine, effectively bypassing the need for an Administrator account for a remote write. There are two...

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot Privilege Escalation Vulnerability in PackageKit TOCTOU Race Condition 📌 Overview CVE-2026-41651 is a local privilege escalation vulnerability affecting the PackageKit system service used in various Linux distributions. The vulnerability is caused by a Time-of-Chec...

CVE-2026-103435

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-41651

Pack2TheRoot — CVE-2026-41651 TOCTOU race in PackageKit's transaction handler. Any local unprivileged user can install arbitrary packages as root with no authentication. Overview Field| Value ---|--- CVE| CVE-2026-41651 Component| PackageKit daemon packagekitd Affected versions| 1.0.2 – 1.3.4 Fix...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

EUVD-2026-94319

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2026-103435

Claude Code is vulnerable to an arbitrary file write due to a time-of-check to time-of-use (TOCTOU) race condition. The software validates that a target file path is within the project working directory during permission checks but re-resolves the path at write time without re-validation. An atta...

CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use TOCTOU gap allowed an attacker who could write to the workspace to...

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...

schrodingers-toctou

Schrödinger's TOCTOU "...the definition of 'sane compiler' grows ever looser." The binary you run is not the program you wrote. The compiler optimizer rewrites your source in ways you never see — and some of those changes can silently and legally turn seemingly secure code into vulnerable binarie...

SNEK_Equinox

SNEK Equinox I would like to thank Nightmare-Eclipse for the inspiration not personal from the project UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Now funnily enough, I found a way to lie to the EDR web console to show that defender is up a...

rbndr

rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...

rbndr

rbndr Servicio simple de Rebinding DNS rbndr es un servidor de nombres muy simple y no conforme para probar software contra vulnerabilidades de DNS rebinding. El servidor responde a consultas seleccionando aleatoriamente una de las direcciones especificadas en el nombre de host y devolviéndola co...

WebKit-CVE-2016-4622

WebKit CVE-2016-4622 Analysis: Deep Dive into the Slice ValueOf Fastpath Vulnerability Comprehensive analysis and exploitation of the WebKit JavaScript Core vulnerability that enables memory disclosure through Array.slice manipulation Table of Contents Executive Summary Vulnerability Overview...

CVE-2024-30088

CVE-2024-30088 Bug: Bug is inside function AuthzBasepCopyoutInternalSecurityAttributes when kernel copies the AUTHZBASEPSECURITYATTRIBUTESINFORMATION of current token object to user mode, which has structure like this: //0x30 bytes sizeof struct AUTHZBASEPSECURITYATTRIBUTESINFORMATION ULONG...

sgxray

SGXRay: Automatización de Detección de Vulnerabilidades para Aplicaciones SGX Intel SGX protege la lógica de aplicación aislada y los datos sensibles dentro de un enclave mediante cifrado de memoria basado en hardware. Para usar este mecanismo de seguridad basado en hardware, se requiere un model...

PlEXcalaison

Local Privilege PlEXcalasion - CVE-2021-42835 Plex Media Server for Windows prior to version 1.25.0.5282, vulnerable to Time Of Check Time Of Use TOCTOU that allows low privilege users to gain SYSTEM privileges. Discovered by Tomer Peled, Netanel Cohen, and Amir Shen a Security Researchers from...

CVE-2026-41651

CVE-2026-41651 CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 Local privilege escalation via TOCTOU race condition in PackageKit's D-Bus transaction handler. Any unprivileged local user can install arbitrary packages as root ...

CVE-2026-61628

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-61628 CVE-2026-61628 nginx-ignition 2.41.0 - lucasdillmann I am @abraxasnull. Loopback lab. The client is CVE-2026-61628-Abraxas-Labs.py. Onboarding is anonymous. First-boot POST /api/users/onboarding/finish...