CWE-367 vulnerabilities

Misskey versions 12.37.0 up to but not including 2026.5.4 contain a time-of-check to time-of-use (TOCTOU) race condition during JSON-LD signature validation and compaction. This flaw arises because the JSON-LD parsing context is not consistently shared between signature verification and later processing, potentially allowing fraudulent data to be accepted as valid. The issue compromises data integrity and has been resolved in version 2026.5.4.

CVE-2026-20492 is a medium severity vulnerability in MediaTek chipsets affecting several models including MT2735, MT2737, MT6880, MT6890, MT6988, and MT6990. It involves a time-of-check to time-of-use (TOCTOU) race condition in the Audio HAL component that can cause the system to become unresponsive, resulting in a local denial of service. Exploitation requires user-level privileges but no user interaction. No official patch or remediation level has been confirmed yet.

In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.

A medium severity vulnerability (CVE-2026-18477) affecting the tar utility in Red Hat Hardened Images and SUSE Linux Enterprise has been addressed by Red Hat. The issue is classified under CWE-367 and fixed in tar version 1.35-9.1.hum1 for relevant architectures including aarch64 and x86_64. No known exploits are reported in the wild. The update is available as part of Red Hat Hardened Images RPMs security update RHSA-2026:49361.

CVE-2026-67433 is a medium severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0. It involves improper link resolution before file access, where a local user controlling the plugin account can create a symbolic link in a predictable /tmp path. This symlink is followed by sqlite3.connect() during a root-run check, potentially leading to unauthorized file access or modification.

CVE-2026-55391 is a high-severity vulnerability in koxudaxi datamodel-code-generator versions prior to 0.63.0. The tool improperly relies on reverse DNS resolution for security-critical decisions, allowing DNS rebinding attacks to bypass network restrictions and potentially access internal services. This issue is fixed in version 0.63.0.

A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10.

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1.

CVE-2026-53410 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the installation and uninstallation process of certain Zoom Clients for Windows. This flaw could allow an authenticated local user to escalate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. No specific affected versions or patches have been disclosed yet.

CVE-2026-15449 is a medium-severity TOCTOU race condition vulnerability in the illumos-gate operating system's data-link pseudo-driver (dld). It affects the handling of specific ioctls on /dev/dld, allowing an unprivileged local user to cause kernel heap corruption and potentially panic the system. The flaw arises from a race condition during copying of ioctl data, leading to a buffer overflow in kernel memory. No patch or official remediation is currently confirmed.

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0.

Adobe Creative Cloud Desktop contains a Time-of-check Time-of-use (TOCTOU) race condition vulnerability that allows arbitrary code execution with the privileges of the current user. The vulnerability does not require user interaction to exploit, but exploitation depends on conditions beyond the attacker's control. The scope of the vulnerability is changed, indicating that it may affect resources beyond the initially intended scope.

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.

Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.

Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.