In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431920; Issue ID: MSV-5835.
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue.
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.
Intego Log Reporter, a macOS diagnostic utility bundled with Intego security products that collects system and application logs for support analysis, contains a local privilege escalation vulnerability. A root-executed diagnostic script creates and writes files in /tmp without enforcing secure directory handling, introducing a time-of-check to time-of-use (TOCTOU) race condition. A local unprivileged user can exploit a symlink-based race condition to cause arbitrary file writes to privileged system locations, resulting in privilege escalation to root.
A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read or write, potentially resulting in loss of confidentiality, integrity, or availability.
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated via ValidateImage(). If validation failed, the file was deleted via @unlink(). This vulnerability is fixed in 5.5.3 - #40.
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property accesses is annotated as string, this is never enforced. So, attackers can pass malicious objects that coerce to different string values when used, e.g., one for the time the key is sanitized using hasOwnProperty(key) and a different one for when the key is used for the actual property access. This vulnerability is fixed in 0.8.29.
CVE-2026-25052 is a critical TOCTOU race condition vulnerability in the n8n workflow automation platform prior to versions 1.123.18 and 2.5.0. Authenticated users with workflow creation or modification permissions can exploit this flaw to bypass file access controls and read sensitive files on the host system. This exposure can lead to disclosure of critical configuration data and user credentials, enabling complete account takeover of any user on the affected instance. The vulnerability requires low privileges but no user interaction and can be exploited remotely. Although no known exploits are reported in the wild yet, the high CVSS score of 9.4 reflects its severe impact on confidentiality, integrity, and availability.
CVE-2026-0924 is a high-severity vulnerability in BuhoCleaner version 1.15.2 involving a Time-of-check Time-of-use (TOCTOU) race condition in an insecure XPC service. This flaw allows local, unprivileged users to escalate their privileges to root by exploiting insecure functions. The vulnerability has a CVSS 4.0 score of 7.3, indicating significant impact but requiring local access and partial user interaction. No patch or official remediation information is currently provided by the vendor.
CVE-2026-24071 is a high-severity TOCTOU race condition vulnerability in Native Instruments' Native Access software, affecting versions up to 3.22.0. The vulnerability arises because the privileged helper's XPC service verifies client code signatures based on the client's PID, which is susceptible to PID reuse attacks. An attacker with low privileges can exploit this flaw to impersonate a trusted process, potentially gaining elevated privileges and causing full compromise of confidentiality, integrity, and availability. Exploitation requires local access and high attack complexity but does not require user interaction. No known exploits are currently in the wild. European organizations using Native Access for managing Native Instruments products are at risk, especially those in music production, audio engineering, and related creative industries. Mitigation involves applying vendor patches once available, restricting local access to trusted users, and monitoring for suspicious local IPC activity. Countries with significant creative industries and high adoption of Native Instruments software, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
CVE-2026-23988 is a high-severity TOCTOU race condition vulnerability in Rufus versions 4.11 and below. Rufus, a popular utility for creating bootable USB drives, runs with Administrator privileges but writes a PowerShell script to the user-writable %TEMP% directory without proper file locking. This allows a local attacker to replace the legitimate script with a malicious one between the write and execution steps, leading to arbitrary code execution with elevated privileges. The vulnerability requires local access and some user interaction but can result in full system compromise. It has been fixed in version 4.12_BETA. No known exploits are currently reported in the wild. European organizations using vulnerable Rufus versions on Windows systems are at risk, especially those with shared or multi-user environments. Mitigation involves upgrading Rufus to 4.
Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.10.1.3, versions starting from 9.11.0.0 and prior to 9.13.0.0, contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to denial of service.
node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.
CVE-2026-21912 is a medium severity TOCTOU race condition vulnerability in Juniper Networks Junos OS affecting MX10k Series with LC480 or LC2101 line cards. A local, low-privileged attacker can repeatedly execute the 'show system firmware' CLI command to cause the affected line cards to crash and restart, potentially leading to chassisd process crashes and core dumps. This vulnerability impacts multiple Junos OS versions prior to specific patch releases. Exploitation does not require user interaction but requires local access with low privileges. The vulnerability results in availability disruption without compromising confidentiality or integrity. No known exploits are currently in the wild. European organizations using MX10k Series routers with these line cards should prioritize patching to prevent potential denial-of-service conditions. Countries with significant Juniper infrastructure deployments and critical network backbones are at higher risk. Mitigation involves applying vendor patches once available and restricting local CLI access to trusted administrators only.
Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.
Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
