CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Kernel Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +3 more +5 moreWindows MIDI Service Module Elevation of Privileges Vulnerability7.0 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows Program Compatibility Assistant Service Elevation of Privilege Vulnerability7.0 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: toctou race condition allows symlink redirection5.8 Medium
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]4.4 Medium
- google chromeRace condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute...7.5 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection7.8 High
- github enterprise serverRace condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution7.7 High
- hugging face transformersHugging Face Transformers library writes remote code to disk prior to consent check7.8 High
- sauter ecos504, ecos505, modu612-lc +2 more +4 moreTOCTOU Vulnerability in file exchange9.3 Critical
- google androidIn multiple locations, there is a possible time-of-check to time-of-use due to a race condition....6.7 Medium
- imagination technologies graphics ddkGPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet2.5 Low
- google androidIn updateInternal of MediaProvider.java, there is a possible expose contents of files due to a...3.3 Low
- z-galaxy zbus polkitzbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID7.3 High
- google cloud buildGoogle Cloud Build Comment Control Bypass via Webhook Suppression9.4 Critical
- klever-io klever-goKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)9.6 Critical
- filebrowserfilebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads2.3 Low
- crossplane crossplane-runtimecrossplane crossplane-runtime ImageConfig client.go Get toctou6.9 Medium
- weblateorg weblateWeblate: DNS rebinding in VCS operations allows server-side request forgery3.5 Low
- spring cloud config, vmware spring cloud config +1 moreSpring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN7.2 High
- freebsdTOCTOU race in POSIX shared memory large page configuration7.8 High
- google chromeRace condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...6.5 Medium
- google chromeRace condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65...5.3 Medium
- google chromeRace condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.3 Medium
- google chromeRace condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to...8.1 High
- google chromeRace condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local...8.1 High
- google chromeRace condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...3.1 Low
- google chromeRace condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.3 Medium
- google chromeRace condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a...4.3 Medium
- google chromeRace condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who...4.3 Medium
- google chromeRace condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had...8.3 High
- google chromeRace condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...8.3 High
- mervinpraison praisonaiPraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation6.8 Medium
- mervinpraison praisonaiPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-401147.1 High
- getgrav gravGrav API Plugin before 1.0.16 SSRF via DNS Rebinding6.9 Medium
- zephyrproject zephyrTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory6.4 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.8 High
- google chromeRace condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to...7.5 High
- nixos nixNix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature2.8 Low
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.3 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.0 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.0 High
- zenhive mpp, machine payments protocol +1 moreNon-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race6.3 Medium
- rockchip rk3588sRockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges7.6 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.7 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU)...7.8 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race...7.3 High
- apache tomcatApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets8.1 High
- Show moreLoading…