4734 matches found
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net/smc: Fixed the race condition between smclistenout and listener close. smclistenout reads lsmc-sk.skstate without acquiring a lock on locksocknested. It only acquires the lock after the check passes. This creates a window...
Astra Linux – vulnerability in linux-6.1, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race condition involvi...
CVE-2025-68404
A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...
CVE-2026-101308
The sound(4) driver in FreeBSD contains a TOCTOU (Time-of-Check Time-of-Use) race condition during audio channel buffer resizing. The driver checks if a buffer is memory-mapped, drops the channel lock to allocate a new buffer, and then frees the old one. A concurrent mmap(2) call can complete dur...
CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap
When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...
CVE-2026-101308 TOCTOU race between sound(4) buffer resizing and mmap
When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...
EUVD-2025-211096
A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...
CVE-2026-94621: Time-of-check Time-of-use (TOCTOU) Race Condition
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated...
CVE-2026-57569: Time-of-check Time-of-use (TOCTOU) Race Condition
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...
CVE-2025-68404: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...
CVE-2026-101308: Time-of-check Time-of-use (TOCTOU) Race Condition
When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...
GitLab 10.3 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-100104)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...
SUSE SLES12: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:4654-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4654-1 advisory. - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges bsc1282509. -...
FreeBSD : FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap (1fef3562-c848-11f1-ada3-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1fef3562-c848-11f1-ada3-bc241121aa0a advisory. When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not...
SUSE SLES11: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / glibc-html / etc (SUSE-SU-2026:4669-1)
The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4669-1 advisory. This update for glibc fixes the following issue: - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate...
Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-130377)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130377 advisory. ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path policy...
CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...
CVE-2026-102354
BentoPDF versions through 2.8.6 are vulnerable to a Server-Side Request Forgery (SSRF) via a Time-of-check Time-of-use (TOCTOU) race condition in the cloudflare/cors-proxy-worker.js component. The issue exists because hostnameResolvesToPrivate() performs a DNS-over-HTTPS safety check separately f...
CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...