CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- linux, linux kernel +1 moreKVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer8.8 High
- linux, linux kernel +1 moremptcp: close TOCTOU race while computing rcv_wnd8.2 High
- sipeed picoclawSipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou4.8 Medium
- openclawOpenClaw < 2026.5.28 Authentication Bypass via safeFetch5.1 Medium
- zoom communications clients, zoom remote control for zoom contact center, rooms +2 more +4 moreZoom Clients for Windows - Race Condition7.0 High
- illumos illumos-gate, mnx smartos, omnios +2 moreTOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption5.8 Medium
- mervinpraison praisonaiPraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl8.4 High
- adobe creative cloud desktop, creative cloud desktop application +1 moreGoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)7.8 High
- blackberry ltd qnx os for safety, qnx software development platform, blackberry ltd. qnx os for medical +2 moreTOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety6.4 Medium
- microsoft windows subsystem for linux (wsl2), windows subsystem for linux +1 moreWindows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability6.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows NFS Server Elevation of Privilege Vulnerability7.5 High
- microsoft defender for endpoint, defender for endpoint for mac +1 moreMicrosoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- microsoft defender for endpoint, defender for endpoint for mac +1 moreMicrosoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability7.0 High
- openclawOpenClaw < 2026.6.9 Symlink Following via Mirror Sync7.6 High
- mervinpraison praisonaiPraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend8.4 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU7.8 High
- decolua 9router9router: Image prefetch DNS rebinding allows SSRF to internal services7.4 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url6.9 Medium
- xen varstoredvarstored: TOCTOU issues with mapped guest memory9.4 Critical
- better-auth, better-auth better auth, better-auth\/oauth-provider +2 moreBetter Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption7.6 High
- @better-auth oauth-provider, better-auth, better-auth better auth +1 more +3 moreBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking8.1 High
- fossbillingFOSSBilling has race condition in cart checkout that bypasses promo code usage limits6.9 Medium
- qualcomm cologne firmware, fastconnect 6900 firmware, fastconnect 7800 firmware +19 more +21 moreTime-of-check Time-of-use (TOCTOU) Race Condition in DSP Service7.8 High
- microsoft edge chromium, edge (chromium-based) +1 moreMicrosoft Edge for Android Remote Code Execution Vulnerability7.5 High
- erlang otp, erlang\/otp, erlang\/ssl +2 moreDTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions8.7 High
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time...8.5 High
- cato networks sdp clientImproper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool6.4 Medium
- samsung open source escargotTime-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot...5.9 Medium
- hieventsdev hi.eventsHi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition8.2 High
- honeywell technologies iq multiaccessLack of signature verification before execution of downloaded content5.9 Medium
- acl project aclacl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl7.2 High
- antlr antlr4antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou2.0 Low
- statamic cmsStatamic: Server-Side Request Forgery via Glide (DNS rebinding)4.9 Medium
- aimeos pagibleAimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy3.0 Low
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++ TOCTOU: HMAC Checks Disk, Executes from Memory7.5 High
- linux, linux kernel +1 morexsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()7.8 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moredrm/gem: Try to fix change_handle ioctl, attempt 47.8 High
- tryghost ghostGhost: Server-side request forgery via DNS rebinding in external request handling4.0 Medium
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moresched/psi: fix race between file release and pressure write7.8 High
- budibaseBudibase: Potential SSRF DNS rebinding bypass in outbound fetch validation8.5 High
- presire qsnapperWeak polkit authentication check in qSnapper8.1 High
- nodejs node, node.js +1 moreA flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before...3.7 Low
- gunthercox chatterbotChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer5.5 Medium
github.com/crossplane/crossplaneGo,github.com/crossplane/crossplane/v2Go +1 moreCrossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag9.0 Critical- corewcfCoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance6.5 Medium
- mcdope pam usbpam_usb: TOCTOU race condition in pad directory creation allows symlink substitution5.8 Medium
- mervinpraison praisonaiPraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding7.2 High
- util-linuxutil-linux mount target TOCTOU allows local privilege escalation7.0 High
- util-linuxutil-linux mount hook_owner TOCTOU allows local privilege escalation7.0 High
- Show moreLoading…