Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
CVE-2025-68404 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in QNAP Systems Inc.'s QuRouter product. This flaw could allow remote attackers to compromise system security. The vulnerability has been fixed in QuRouter version 2.6.4.001 and later.
CVE-2026-102354 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in BentoPDF versions prior to 2.8.7. The issue arises from a DNS-over-HTTPS safety check performed separately from the outbound fetch, allowing an attacker controlling authoritative DNS to potentially bypass hostname resolution checks under specific conditions. Exploitation requires precise timing and network conditions, and the vulnerability is fixed in version 2.8.7.
CVE-2026-62840 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Linux Kernel used by Microsoft Linux 3P (Third Party) Distros. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects versions from 1.0.0 up to but not including 7.3. A fix is available in version 7.3.
CVE-2026-108396 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Windows Modern Device Management (MDM) on Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 versions prior to specific fixed builds. A patch is available from Microsoft.
CVE-2026-96939 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Servicing Stack Updates component of Microsoft Windows 11 version 23H2. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 11 version 23H2 prior to specific fixed versions. Microsoft has released official fixes for the affected versions to address this issue.
CVE-2026-96853 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Win32 Kernel Subsystem affecting multiple versions of Windows 10. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.7. Microsoft has released official fixes for all affected versions.
CVE-2026-70122 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Broadcast DVR User Service on Microsoft Windows 10 Version 21H2 and related builds. This flaw allows a local authorized attacker to elevate privileges. The vulnerability has been assigned a CVSS v3.1 score of 6.5 (medium severity). Microsoft has released official fixes for affected versions.
CVE-2026-85943 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Reliable Multicast Transport Driver (RMCAST) component of Microsoft Windows 10 Version 1607 and related versions. It allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.0. Official patches have been released to address this issue.
CVE-2026-85879 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Windows Subsystem for Linux (WSL2) that allows a local authorized attacker to elevate privileges. The flaw affects versions from 5.0.0.0 up to but not including 2.7.10. Microsoft has released an official fix in version 2.7.10 to address this issue.
CVE-2026-83750 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Windows Error Reporting on Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7. A fix is available in multiple updated Windows 10 versions.
CVE-2026-83697 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Windows Modern Device Management (MDM) affecting Windows 10 Version 1809 and later builds. This flaw allows an authorized local attacker to perform tampering due to a race condition between checking and using a resource. The vulnerability has a medium severity score of 4.7 and does not impact confidentiality or availability but can impact integrity. Official patches are available for all affected versions.
CVE-2026-83505 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Setup Files Cleanup component of Microsoft Windows 10 Version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. Microsoft has released official fixes for affected versions.
CVE-2026-70288 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Win32 Kernel Subsystem affecting Windows 10 Version 1607 and other versions. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue in multiple Windows 10 builds.
CVE-2026-70075 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Virtualization-Based Security (VBS) Enclave of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to bypass a security feature. The vulnerability has a medium severity rating with a CVSS score of 4.4. Official patches have been released to address this issue in multiple Windows 10 builds.
CVE-2026-97774 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Microsoft Office Click-To-Run component of Microsoft 365 Apps for Enterprise. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.0 and has been officially fixed by Microsoft. No known exploits are reported in the wild.
CVE-2026-88173 is a use-after-free vulnerability in the Windows Background Intelligent Transfer Service (BITS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.1. Microsoft has released official fixes for all affected versions.
CVE-2026-85920 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Windows BitLocker on Windows 10 Version 1607 and other specified versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7. A fix is officially available in multiple Windows updates.
CVE-2026-84018 is a use-after-free vulnerability in the Windows Print Spooler components affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available and has been released in specific Windows 10 builds.
CVE-2026-84009 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Windows Projected File System on Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to perform tampering by exploiting the race condition. The vulnerability has a medium severity score of 4.7 and has been officially fixed by Microsoft in various Windows 10 versions.