CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- freebsdLocal privilege escalation via execve(2) TOCTOU race8.8 High
- google chromeRace condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had...8.3 High
- netflix lemurLemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)6.3 Medium
- azuriom cmsAzuriom CMS Money Transfer ProfileController.php transferMoney toctou2.3 Low
- ibm mcp-context-forge, mcp-contextforge-gateway +1 moreContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)6.6 Medium
- ibm iIBM i is Affected By Multiple SQL Vulnerabilities [, ]8.5 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Network Authentication Service7.1 High
- rsyncproject rsyncrsync < 3.5.0 Symlink Race Condition Directory Traversal8.2 High
- rsyncproject rsyncrsync < 3.5.0 Symlink Race Condition via --remove-source-files5.7 Medium
- rsyncproject rsyncrsync < 3.5.0 Symlink Race Condition via ACL/xattr Application7.2 High
- rsyncproject rsyncrsync < 3.5.0 Symlink Race Condition Information Disclosure5.7 Medium
- rsyncproject rsyncrsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling5.8 Medium
- canonical lxdCross-project instance copy bypasses target project restrictions via TOCTOU in config merge9.9 Critical
- zephyrproject zephyrTOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Common Log File System Driver Elevation of Privilege Vulnerability7.0 High
- intel neural processing unit driverTime-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions...5.8 Medium
- axis communications ab osThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could...5.1 Medium
- axis communications ab osThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could...5.7 Medium
- linuxdrm/amdgpu/vcn4: avoid rereading IB param length8.8 High
- fastschemafastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery7.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolicycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation4.4 Medium
- ggml llama.cppllama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints9.2 Critical
- apache cxfApache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider8.1 High
- mervinpraison praisonaiPraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)7.5 High
- electronElectron: Parent process code-sign check is spoofable6.3 Medium
- usememos memosMemos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()8.5 High
- mealie-recipes mealiemealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: DNS Rebinding SSRF Bypass6.3 Medium
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition...6.5 Medium
- caliptra core romCaliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)5.6 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability6.5 Medium
- misskey-dev misskeyMisskey: JSON-LD signature validation + compaction is vulnerable to timing attacks8.9 High
- gnu tar, red hat discovery 2, enterprise linux 10 +10 more +12 moreTar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape4.4 Medium
- mediatek mt2735 firmware, mt2737 firmware, mt6880 firmware +4 more +6 moreIn Audio HAL, there is a possible system becoming unresponsive due to a race condition. This...5.5 Medium
- mediatek mt6991 firmware, mt6993 firmware, mt8126 firmware +15 more +17 moreIn display, there is a possible escalation of privilege due to a race condition. This could lead...6.0 Medium
- hfiref0x lightftpLightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup8.2 High
- nodejs nodeA flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync...5.3 Medium
- linuxfabrik monitoring-pluginsLinuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration5.8 Medium
- gitlabTime-of-check Time-of-use (TOCTOU) Race Condition in GitLab6.5 Medium
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding7.5 High
- xengrant-table: type confusion in grant-copy7.8 High
- linux, linux kernel +1 moreKVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits7.1 High
- budibaseBudibase: SSRF via DNS rebinding in the REST datasource integration8.5 High
Magick.NET-Q16-AnyCPUNuGet,Magick.NET-Q16-arm64NuGet,Magick.NET-Q16-HDRI-AnyCPUNuGet +14 more +16 moreImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-492194.7 Medium- selinuxproject selinuxLocal File Deletion Attack Vector in rm_rf() in seunshare5.8 Medium
- n8n-io n8nn8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution8.9 High
- n8nn8n before 1.123.64 Remote Code Execution via Git Clone8.9 High
- linux, linux kernel +1 morerbd: eliminate a race in lock_dwork draining on unmap7.8 High
- linux, linux kernel +1 morebatman-adv: tt: fix TOCTOU race for reported vlans9.8 Critical
- linux, linux kernel +1 morenet: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer9.3 Critical
- Show moreLoading…