CVE-2026-13113

GitLab EE contained a TOCTOU race condition in approval rule processing that could allow an authenticated user to merge into a protected branch without the required approvals. Affected versions: 17.0–before 19.0.5, 19.1–before 19.1.3, and 19.2–before 19.2.1. Remediation: patches released (e.g., 1...

Siemens SIMATIC S7-1500 CPU 1518 MFP Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-2026-23287)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505751; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

UBUNTU-CVE-2026-59676

A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...

CVE-2026-59676

A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview io.netty:netty-handler-ssl-ocsp is a Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Conditio...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598

CVE-2026-65598 affects n8n versions before 1.123.64 (also 2.29.8 and 2.30.1). A TOCTOU race in the Git node’s clone operation allows an authenticated user to bypass path restrictions by swapping a directory for a symlink after path validation but before the clone runs. An attacker can plant a cra...

RockyLinux 9 : acl (RLSA-2026:42736)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42736 advisory. acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54369 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVE-2026-54370 Tenable...

CVE-2026-12080

CVE-2026-12080 affects the QEMU Guest Agent (qga). A local, unprivileged user can exploit the guest-ssh-add-authorized-keys handler by manipulating symbolic links through a deterministic directory-symlink bypass or a TOCTOU file-symlink race, enabling ownership of arbitrary root-owned files/direc...

Important: acl

Issue Overview: A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or wri...

Linux Distros Unpatched Vulnerability : CVE-2026-64091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. ...

Linux Distros Unpatched Vulnerability : CVE-2026-63867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different value...

Amazon Linux 2023 : acl, libacl, libacl-devel (ALAS2023-2026-1986)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1986 advisory. A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname...

CVE-2026-64091

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

CVE-2026-64112 rbd: eliminate a race in lock_dwork draining on unmap

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

CVE-2026-64112

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

CVE-2026-64091

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...