CVE-2026-78464 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows MIDI Service Module of Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges. The vulnerability affects specific builds of Windows 11 Version 24H2 prior to fixed versions 10.0.26100.9445, 10.0.26200.9445, and 10.0.28000.2954. An official fix is available from Microsoft.
CVE-2026-69779 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Win32K component affecting Windows 10 Version 1607 and related builds. This flaw allows a locally authorized attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7. An official fix is available and has been released in multiple Windows 10 builds.
CVE-2026-69466 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Kernel affecting Windows 10 Version 1607 and other specified versions. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score and has been officially fixed in multiple Windows 10 builds.
CVE-2026-69440 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows MIDI Service Module of Microsoft Windows 11 Version 24H2. This flaw allows a local authorized attacker to elevate privileges. The vulnerability affects specific builds of Windows 11 Version 24H2 prior to fixed versions 10.0.26100.9445, 10.0.26200.9445, and 10.0.28000.2954. A patch is available from Microsoft to address this issue.
CVE-2026-69804 is a high-severity time-of-check to time-of-use (TOCTOU) race condition vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to execute code remotely over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20090. An official fix is available in version 16.0.20326.20090.
CVE-2026-69859 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows USB Audio Class driver (usbaudio.sys) affecting multiple versions of Microsoft Windows 10, including version 1607 and later builds. This flaw allows a locally authorized attacker to elevate privileges. The vulnerability has been assigned a high severity score and has been officially fixed in specific Windows 10 builds.
CVE-2026-69563 is a heap-based buffer overflow vulnerability in the Windows Program Compatibility Assistant Service affecting multiple builds of Windows 10 Version 1607 and later. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity score and has been officially fixed in specific Windows 10 builds.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.
CVE-2026-45197 is a low-severity time-of-check to time-of-use (TOCTOU) race condition vulnerability in Imagination Technologies Graphics DDK. It affects kernel software running inside a Guest VM that interacts with the GPU Firmware. The flaw allows improper commands to be posted to the GPU Firmware, potentially causing reads or writes outside the Guest's virtualized GPU memory due to a TOCTOU bug in memory access validation.
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.
A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition.
An unauthenticated remote attacker could exploit this race condition to bypass intended security controls.
This may result in the execution of unauthorized code.
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race.
Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to.
This issue affects zbus_polkit before 5.1.0.
CVE-2026-19410 is a critical time-of-check time-of-use (TOCTOU) race condition vulnerability in Google Cloud Build's GitHub Trigger Comment Control. It allows a remote attacker to execute unreviewed code in the build environment by exploiting webhook suppression. This vulnerability was patched by Google on June 24, 2026, and no customer action is required.
CVE-2026-54754 is a critical integer underflow vulnerability in klever-io's klever-go blockchain protocol implementation prior to version 1.7.19. It involves marketplace settlement logic where combined referral and royalty percentages can exceed the bid amount, causing the system to credit more tokens than the buyer paid. This leads to creation of unbacked currency and corruption of token supply integrity. The issue is fixed in version 1.7.19.
CVE-2026-77573 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Weblate versions prior to 2026.8. It allows a user with permission to manage component repository URLs to perform server-side request forgery (SSRF) against internal services via DNS rebinding during version control system (VCS) operations. The vulnerability arises because Weblate validates the hostname's initial DNS resolution but the external VCS clients perform a separate DNS lookup later, enabling an attacker-controlled hostname to be redirected to internal or private addresses. This can lead to unauthorized access to internal VCS-compatible services and potential exposure of private repository contents. The issue affects installations that allow untrusted repository hostnames while using the VCS_RESTRICT_PRIVATE=True setting. The vulnerability is fixed in Weblate version 2026.8.
CVE-2026-47836 is a high-severity time-of-check time-of-use (TOCTOU) race condition vulnerability in Spring Cloud Config Server. It affects the base directory used to clone SVN repositories, potentially allowing an attacker to exploit the timing window between checking and using the directory path. The vulnerability impacts multiple versions of Spring Cloud Config, including 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-65183 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat affecting unix domain socket creation. It allows an unauthorized local user to access the unix domain socket. The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120. Upgrading to versions 11.0.25, 10.1.58, or 9.0.121 mitigates the issue. The CVSS score is 8.1, indicating high severity.
CVE-2026-55535 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 4.6.58, the Jobs API's validate_webhook_url() function fails open on socket.gaierror and does not bind the validated address to the subsequent request. This allows an attacker to supply a webhook_url that later resolves to internal addresses such as 127.0.0.1 or 169.254.169.254. The issue is fixed in version 4.6.58.