CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile8.8 High
- openclawOpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations4.3 Medium
- openclawOpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay6.3 Medium
- No product listedA Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows...7.5 High
- linuxfoundation onnxONNX symlink-following and path-traversal arbitrary file write6.8 Medium
- anthropic claude sdk for python, anthropics anthropic-sdk-python +1 moreClaude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape5.8 Medium
- pop-os cosmic-greeterIncomplete privilege drop for com.system76.CosmicGreeter.GetUserData5.8 Medium
- parse-community parse-serverParse Server: MFA single-use token bypass via concurrent authData login requests2.1 Low
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion9.8 Critical
- handlebars-lang handlebars.js, handlebarsjs handlebars +1 moreHandlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection4.7 Medium
- openclawOpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions2.3 Low
- parse-community parse-serverParse Server: MFA recovery code single-use bypass via concurrent requests2.1 Low
- parse-community parse-serverParse Server has a password reset token single-use bypass via concurrent requests2.3 Low
- xenUse after free of paging structures in EPT7.8 High
- openclawOpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation5.8 Medium
- openclawOpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host Approval7.0 High
- openclawOpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path5.8 Medium
openclawnpmOpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary7.0 High- openclawOpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download5.8 Medium
- openclawOpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run5.3 Medium
- No product listedTime-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference...5.6 Medium
- No product listedTime-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference...7.1 High
- syliusSylius has a Promotion Usage Limit Bypass via Race Condition8.2 High
- codesys installerCODESYS Installer TOCTOU Privilege Escalation7.3 High
- imagemagickImageMagick has a Path Policy TOCTOU symlink race bypass6.3 Medium
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS ACL Bypass7.7 High
- avira internet security, gen digital inc. avira internet security +1 moreAvira Internet Security Optimizer TOCTOU7.8 High
openclawnpmOpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model2.3 Low- openclawOpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition5.8 Medium
- openclawOpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations4.8 Medium
- openclawOpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch6.1 Medium
- openclawOpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter5.9 Medium
- openclawOpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind6.9 Medium
- openclawOpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals4.4 Medium
openclawnpmOpenClaw: Sandbox media TOCTOU could read files outside sandbox root8.7 HighopenclawnpmOpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries8.7 High- google android, mediatek, inc. mediatek chipset +1 moreIn MDDP, there is a possible system crash due to a race condition. This could lead to local...4.4 Medium
- google android, mediatek, inc. mediatek chipset +1 moreIn MAE, there is a possible out of bounds write due to a race condition. This could lead to local...6.4 Medium
- grafanaAuthorization Bypass via TOCTOU in Grafana Datasource Deletion by Name2.6 Low
- craftcms cms, craft cms +1 moreCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limit6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding7.0 High
- opensiftOpenSift: Race-prone local persistence could cause state corruption/loss6.6 Medium
- linux, linux kernel +1 morebonding: annotate data-races around slave->last_rx4.7 Medium
- linux, linux kernel +1 moremd: suspend array while updating raid_disks via sysfs5.3 Medium
- cern indicoIndico has Server-Side Request Forgery (SSRF) in multiple places6.9 Medium
- mattermost, mattermost server +1 moreTime-of-check time-of-use vulnerability in common teams API3.1 Low
- Show moreLoading…