Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the HTML backend's...

CVE-2026-104977 Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected...

CVE-2026-104970 Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first for the first-admin check and performs account creation without an atomic transaction, row lock,...

CVE-2026-104970

The Plane project management tool (versions 0.13 through 1.4.0) contains a Time-of-Check to Time-of-Use (TOCTOU) race condition within the InstanceAdminSignUpEndpoint located in apps/api/plane/license/api/views/admin.py. The vulnerability arises because the system performs a first-admin check usi...

CVE-2026-104970 Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first for the first-admin check and performs account creation without an atomic transaction, row lock,...

CVE-2026-104970 Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first for the first-admin check and performs account creation without an atomic transaction, row lock,...

CVE-2026-77804

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use TOCTOU race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary...

CVE-2026-77804 Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use TOCTOU race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary...

CVE-2026-77804

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021 , a time-of-check time-of-use (TOCTOU) race condition exists during the installation of the HTTPS interception root certificate. The software writes a certificate to a user-writable temporary file before launch...

EUVD-2026-92427

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use TOCTOU race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary...

CVE-2026-77804 Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use TOCTOU race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: MPTCP: A race condition occurs when closing TOCTOU while calculating rcvwnd. The MPTCP output path accesses the ackseq variable without proper locking mechanisms at the MPTCP level. This occurs multiple times, with possibly...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

PT-2026-105989

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic versions prior to 6.0.20262.10021 Description A time-of-check time-of-use TOCTOU race condition occurs during the installation of the HTTPS interception root certificate into the Local Computer certificate stor...

CVE-2026-93315: Time-of-check Time-of-use (TOCTOU) Race Condition

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...