A symlink race condition vulnerability exists in rsync versions up to 3.4.4 that allows local attackers to redirect the application of ACLs or extended attributes to unintended files by substituting a symlink during a timing window. This can lead to elevated permissions and local privilege escalation.
A symlink race condition vulnerability exists in rsync versions up to 3.4.4. This flaw allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths by replacing a directory component with a symlink during traversal. This can lead to disclosure of file contents outside the intended transfer root.
A time-of-check to time-of-use (TOCTOU) race condition exists in rsync before version 3.5.0 in the non-daemon receiver's handling of the destination directory. This vulnerability allows an attacker who can manipulate the destination path's parent components to redirect file writes to unintended locations by substituting a symlink between path resolution and the directory change operation. This causes the working directory to be set outside the intended destination tree, potentially leading to unauthorized file writes.
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.
Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.
CVE-2026-57818 is a high-severity race condition vulnerability in Apache CXF's JCacheCodeDataProvider component. It allows an attacker to redeem a single authorization code multiple times through concurrent requests, resulting in multiple valid access tokens being issued. This flaw can lead to unauthorized access and potential privilege escalation. Fixed versions 4.2.3, 4.1.8, and 3.6.12 address this issue.
PraisonAI versions prior to 1.6.58 contain a time-of-check to time-of-use (TOCTOU) race condition in the web_crawl tool's SSRF protection. The tool validates the initial URL's hostname against private, loopback, and link-local addresses only once, but then follows redirects and re-resolves hostnames without revalidating. This allows attackers to bypass SSRF protections via HTTP redirects or DNS rebinding, potentially causing the host to fetch internal or cloud metadata endpoints and expose sensitive data. The issue is fixed in version 1.6.58.
Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address.
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering.
CVE-2026-58041 is a medium severity vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It involves a time-of-check to time-of-use (TOCTOU) race condition in the node:sqlite module, where a stale StatementSyncIterator can continue executing a cached prepared statement after it has been reset and rebound with new parameters. This occurs because SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases.
CVE-2026-11835 is a medium-severity TOCTOU race condition vulnerability in Caliptra Core ROM versions 2.1.0 through 2.1.1. It allows a compromised local attacker with high privileges to bypass secure boot by exploiting missing input validation in the UpdateResetFlow::run() function. The attacker can supply an unvalidated AXI staging address to modify firmware after verification but before loading, while attestation reports the original verified image digest, masking the compromise.
Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.