CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (page 4)
Page 4 of 8 — CVEs classified under CWE-367, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3464 | | 2025-06-16 | A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication… | |
CVE-2024-9512 | Medium | 5.3 | 2025-06-12 | An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible… |
CVE-2025-21485 | High | 7.8 | 2025-06-03 | Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC. |
CVE-2024-53018 | Medium | 6.6 | 2025-06-03 | Memory corruption may occur while processing the OIS packet parser. |
CVE-2024-53016 | Medium | 6.6 | 2025-06-03 | Memory corruption while processing I2C settings in Camera driver. |
CVE-2025-46805 | Medium | 5.5 | 2025-05-26 | Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setui… |
CVE-2025-34027 | | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to… | |
CVE-2025-47290 | Medium | 5.9 | 2025-05-20 | containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an ima… |
CVE-2025-30663 | High | 8.8 | 2025-05-14 | Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2025-20082 | High | 7.5 | 2025-05-13 | Time-of-check time-of-use race condition in the UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user t… |
CVE-2025-29969 | High | 7.5 | 2025-05-13 | Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network. |
CVE-2025-29833 | High | 7.7 | 2025-05-13 | Time-of-check time-of-use (toctou) race condition in Windows Virtual Machine Bus allows an unauthorized attacker to execute code locally. |
CVE-2024-42446 | High | 7.5 | 2025-05-13 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation… |
CVE-2024-13961 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attac… |
CVE-2024-13960 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to esca… |
CVE-2024-13944 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows… |
CVE-2025-46336 | Medium | 4.2 | 2025-05-08 | Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware… |
CVE-2025-30101 | Medium | 4.4 | 2025-05-08 | Dell PowerScale OneFS, versions 9.8.0.0 through 9.10.1.0, contain a time-of-check time-of-use (TOCTOU) race condition vulnerability. An unauthenticated attacke… |
CVE-2025-32441 | Medium | 4.2 | 2025-05-07 | Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a… |
CVE-2024-45565 | High | 7.8 | 2025-05-06 | Memory corruption when blob structure is modified by user-space after kernel verification. |
CVE-2024-6029 | Medium | 5.0 | 2025-04-30 | Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris… |
CVE-2025-3599 | Medium | 6.5 | 2025-04-30 | Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which m… |
CVE-2025-46328 | Low | 3.3 | 2025-04-28 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (T… |
CVE-2025-46327 | Low | 3.3 | 2025-04-28 | gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condi… |
CVE-2025-46326 | Low | 3.3 | 2025-04-28 | snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TO… |
CVE-2025-22060 | Medium | 4.7 | 2025-04-16 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, an… |
CVE-2025-32784 | | 2025-04-15 | conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability h… | |
CVE-2025-27812 | High | 8.1 | 2025-04-10 | MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation. |
CVE-2025-21191 | High | 7.0 | 2025-04-08 | Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. |
CVE-2025-21431 | Medium | 5.5 | 2025-04-07 | Information disclosure may be there when a guest VM is connected. |
CVE-2024-43067 | High | 7.8 | 2025-04-07 | Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory. |
CVE-2025-21998 | Medium | 4.7 | 2025-04-03 | In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using t… |
CVE-2025-21958 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_… |
CVE-2024-54084 | High | 7.5 | 2025-03-11 | APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation… |
CVE-2024-53694 | | 2025-03-07 | A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could a… | |
CVE-2025-22224 | Critical | 9.3 | 2025-03-04 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local admi… |
CVE-2024-53032 | High | 7.8 | 2025-03-03 | Memory corruption may occur in keyboard virtual device due to guest VM interaction. |
CVE-2024-53028 | High | 7.8 | 2025-03-03 | Memory corruption may occur while processing message from frontend during allocation. |
CVE-2025-0759 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization. |
CVE-2025-21746 | Medium | 4.7 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through… |
CVE-2025-26620 | | 2025-02-18 | Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condit… | |
CVE-2024-41917 | High | 7.5 | 2025-02-12 | Time-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authenticated user to potent… |
CVE-2025-23359 | High | 8.3 | 2025-02-12 | NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container… |
CVE-2025-24432 | Low | 3.7 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition v… |
CVE-2025-24430 | Low | 3.7 | 2025-02-11 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition v… |
CVE-2025-24036 | High | 7.0 | 2025-02-11 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
CVE-2024-48394 | High | 7.8 | 2025-02-05 | A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to ex… |
CVE-2024-45560 | High | 7.8 | 2025-02-03 | Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer. |
CVE-2024-38418 | High | 7.8 | 2025-02-03 | Memory corruption while parsing the memory map info in IOCTL calls. |
CVE-2024-37181 | Low | 2.6 | 2025-01-16 | Time-of-check time-of-use race condition in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable… |
CVE-2025-22394 | Medium | 6.7 | 2025-01-15 | Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with loc… |
CVE-2024-42444 | High | 7.5 | 2025-01-14 | APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may l… |
CVE-2024-41787 | Critical | 9.8 | 2025-01-10 | IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. B… |
CVE-2024-56337 | Critical | 9.8 | 2024-12-20 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0… |
CVE-2024-50379 | Critical | 9.8 | 2024-12-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when th… |
CVE-2024-10972 | High | 7.3 | 2024-12-16 | Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a… |
CVE-2024-53289 | High | 7.8 | 2024-12-11 | Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentia… |
CVE-2024-27134 | High | 7.0 | 2024-11-25 | Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain… |
CVE-2024-41779 | Critical | 9.8 | 2024-11-22 | IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race conditi… |
CVE-2024-22185 | High | 7.2 | 2024-11-13 | Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privile… |
CVE-2024-49046 | High | 7.8 | 2024-11-12 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
CVE-2024-43452 | High | 7.5 | 2024-11-12 | Windows Registry Elevation of Privilege Vulnerability |
CVE-2024-51563 | Medium | 6.5 | 2024-11-12 | The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition. |
CVE-2024-48322 | High | 8.1 | 2024-11-11 | UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. |
CVE-2024-50234 | High | 7.0 | 2024-11-09 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume f… |
CVE-2024-50220 | Medium | 4.7 | 2024-11-09 | In the Linux kernel, the following vulnerability has been resolved: fork: do not invoke uffd on fork if error occurs Patch series "fork: do not expose incomp… |
CVE-2024-50592 | High | 7.0 | 2024-11-08 | An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition… |
CVE-2024-38407 | High | 7.8 | 2024-11-04 | Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver. |
CVE-2024-38406 | High | 7.8 | 2024-11-04 | Memory corruption while handling IOCTL calls in JPEG Encoder driver. |
CVE-2024-49768 | Critical | 9.1 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, fo… |
CVE-2024-49998 | Medium | 4.7 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdow… |
CVE-2024-47494 | Medium | 5.9 | 2024-10-11 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing… |
CVE-2024-45120 | Low | 3.1 | 2024-10-10 | Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability t… |
CVE-2024-47813 | Low | 2.9 | 2024-10-09 | Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s internal type registry was susceptible to… |
CVE-2024-43511 | High | 7.0 | 2024-10-08 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-5803 | High | 7.5 | 2024-10-03 | The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time… |
CVE-2024-0133 | Medium | 4.1 | 2024-09-26 | NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create emp… |
CVE-2024-0132 | Critical | 9.0 | 2024-09-26 | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specificall… |
CVE-2024-6787 | Medium | 5.3 | 2024-09-21 | This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this ra… |
CVE-2024-27114 | Critical | 9.8 | 2024-09-11 | A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker… |
CVE-2024-43882 | High | 7.8 | 2024-08-21 | In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec vi… |
CVE-2024-39425 | High | 7.0 | 2024-08-14 | Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition… |
CVE-2024-39420 | High | 7.0 | 2024-08-14 | Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected… |
CVE-2024-38186 | High | 7.8 | 2024-08-13 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
CVE-2024-38153 | High | 7.8 | 2024-08-13 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2023-20578 | High | 7.5 | 2024-08-13 | A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications… |
CVE-2024-7348 | High | 8.8 | 2024-08-08 | Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_d… |
CVE-2024-7531 | Medium | 6.5 | 2024-08-06 | Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Fire… |
CVE-2024-42107 | Medium | 4.7 | 2024-07-30 | In the Linux kernel, the following vulnerability has been resolved: ice: Don't process extts if PTP is disabled The ice_ptp_extts_event() function can race w… |
CVE-2024-30471 | Low | 3.7 | 2024-07-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request… |
CVE-2024-39826 | Medium | 6.8 | 2024-07-15 | Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network acc… |
CVE-2024-39821 | Medium | 6.6 | 2024-07-15 | Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of servic… |
CVE-2024-27238 | High | 7.1 | 2024-07-15 | Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation… |
CVE-2024-27361 | Medium | 5.1 | 2024-07-09 | A vulnerability was discovered in Samsung Mobile Processor Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, and Exynos… |
CVE-2024-6601 | Medium | 4.7 | 2024-07-09 | A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR <… |
CVE-2024-39936 | High | 8.6 | 2024-07-04 | An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make… |
CVE-2024-39894 | High | 7.5 | 2024-07-02 | OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming… |
CVE-2022-27540 | High | 7.8 | 2024-06-28 | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code… |
CVE-2024-0171 | Medium | 5.3 | 2024-06-25 | Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gai… |
CVE-2024-5558 | Medium | 6.4 | 2024-06-12 | CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited adm… |