Total
919 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25271 | 1 Qualcomm | 42 Cologne, Cologne Firmware, Fastconnect 6900 and 39 more | 2026-10-25 | N/A | 7.8 HIGH |
| Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use. | |||||
| CVE-2026-13502 | 2026-10-25 | 3.5 LOW | 4.5 MEDIUM | ||
| A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is restricted to local execution. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-58198 | 2026-10-25 | N/A | 5.5 MEDIUM | ||
| ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14. | |||||
| CVE-2026-12374 | 2026-10-25 | N/A | N/A | ||
| Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation. | |||||
| CVE-2026-56676 | 2026-10-25 | N/A | 7.4 HIGH | ||
| 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2. | |||||
| CVE-2026-45203 | 3 Google, Imaginationtech, Linux | 3 Android, Ddk, Linux Kernel | 2026-10-25 | N/A | 7.8 HIGH |
| Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use. | |||||
| CVE-2026-58299 | 2 Google, Microsoft | 2 Android, Edge Chromium | 2026-10-25 | N/A | 7.5 HIGH |
| Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-45804 | 1 Huggingface | 1 Diffusers | 2026-10-24 | N/A | 7.5 HIGH |
| Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0. | |||||
| CVE-2026-57973 | 1 Microsoft | 1 Windows Subsystem For Linux | 2026-10-24 | N/A | 6.3 MEDIUM |
| Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally. | |||||
| CVE-2026-56178 | 1 Microsoft | 1 Defender For Endpoint | 2026-10-24 | N/A | 5.5 MEDIUM |
| Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-48344 | 2 Adobe, Microsoft | 2 Creative Cloud Desktop Application, Windows | 2026-10-24 | N/A | 7.8 HIGH |
| Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-50658 | 1 Microsoft | 1 Defender For Endpoint | 2026-10-24 | N/A | 7.0 HIGH |
| Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-16082 | 2026-10-24 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot. | |||||
| CVE-2026-54242 | 2026-10-24 | N/A | 4.9 MEDIUM | ||
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1. | |||||
| CVE-2026-53410 | 1 Zoom | 4 Remote Control For Zoom Contact Center, Rooms, Workplace Desktop and 1 more | 2026-10-24 | N/A | 7.0 HIGH |
| A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges. | |||||
| CVE-2026-53800 | 1 Samba | 1 Rsync | 2026-10-24 | N/A | 4.7 MEDIUM |
| rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file. | |||||
| CVE-2026-53799 | 1 Samba | 1 Rsync | 2026-10-24 | N/A | 6.3 MEDIUM |
| rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation. | |||||
| CVE-2026-53797 | 1 Samba | 1 Rsync | 2026-10-24 | N/A | 4.7 MEDIUM |
| rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root. | |||||
| CVE-2026-55524 | 2026-10-24 | N/A | 7.5 HIGH | ||
| PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58. | |||||
| CVE-2026-6505 | 2026-10-24 | N/A | 5.1 MEDIUM | ||
| The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | |||||