CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open

CVE-2026-11111 – TOCTOU in File Permission Check Before Open Program Code Python root@kitploit: toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def readfile: filename...

CVE-2026-49114

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-73829 Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race

Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...

PT-2026-79395

Name of the Vulnerable Software and Affected Versions ONNX versions prior to 1.21.0 Description The save external data function constructs an external-data file path using the external data location field and opens it for writing without using O NOFOLLOW or O EXCL flags, following a non-atomic...

PT-2023-17408 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator WordPress plugin versions prior to 1.24.1 Description: The issue arises from the plugin not using an atomic operation to check whether a user has already voted and then update that information, leading to a Race Condition. This...