Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
CVE-2026-50631 is a high-severity race condition vulnerability in Apache CXF's AbstractOAuthDataProvider. It allows concurrent requests using the same refresh token to bypass single-use restrictions and generate multiple valid access tokens when 'recycleRefreshTokens' is set to false. This flaw can enable attackers to replay a leaked refresh token concurrently, potentially compromising access control. Fixed versions include 4.2.2, 4.1.7, and 3.6.12.
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.
Time-of-check time-of-use (TOCTOU) race condition in Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.
SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
CVE-2026-25260 is a high-severity vulnerability in Qualcomm Snapdragon products involving a time-of-check to time-of-use (TOCTOU) race condition. It results in memory corruption due to accessing shared buffers without validating concurrent modifications from user-mode input. This vulnerability affects multiple Snapdragon components and chipsets. No official patch or remediation guidance has been provided yet.
CVE-2026-20454 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MediaTek chipsets affecting multiple versions. It involves a possible out-of-bounds write in the geniezone component, which could allow a local attacker with existing System privileges to escalate their privileges further. Exploitation does not require user interaction. The vulnerability has a CVSS score of 6.4, indicating medium severity. No official patch or remediation guidance is currently confirmed from the vendor. There are no known exploits in the wild at this time.
WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
MaxKB versions 2.8.0 and earlier contain a server-side request forgery (SSRF) bypass vulnerability caused by a time-of-check to time-of-use (TOCTOU) race condition in the OSS file service URL fetch functionality. This occurs due to inconsistent DNS resolution between the validation step and the actual request execution, potentially allowing attackers to access internal network services. The issue is addressed in version 2.8.1. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.
CVE-2026-24191 is a high-severity vulnerability in the NVIDIA Display Driver for Windows affecting GeForce products prior to version 596.36. It is a time-of-check time-of-use (TOCTOU) race condition that could allow an attacker to cause denial of service, escalate privileges, disclose information, tamper with data, or execute code. The vulnerability requires local access with low privileges and high attack complexity. No official patch or remediation guidance has been provided yet by NVIDIA. There are no known exploits in the wild at this time.
CVE-2026-45208 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Trend Micro's TrendAI Apex One agent version 2019 (14.0). It allows a local attacker with low-privileged code execution to escalate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided by the vendor. Exploitation requires prior local access, and no known exploits are reported in the wild.
Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message.
This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.
BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an attacker to trigger a heap-based buffer overflow, potentially resulting in denial-of-service within the vulnerable system context.