CWE-367

Medium likelihood

Time-of-check Time-of-use (TOCTOU) Race Condition

Parent: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

589 vulnerabilities with CWE-367
CVE-2026-1880 MEDIUM
Asus DriverHub < 1.0.6.12 - Privilege Escalation
CVE-2026-3590 MEDIUM
Race Condition in Guest Magic Link Authentication Allows Token Reuse
CVSS 6.5
CVE-2026-32093 HIGH
Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability
CVSS 7.0
CVE-2026-27929 HIGH
Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability
CVSS 7.0
CVE-2026-33659 LOW
EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
CVSS 3.5
CVE-2026-35648 LOW
OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions
CVSS 3.7
CVE-2026-4878 MEDIUM
Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
CVSS 6.7
CVE-2026-32602 MEDIUM
Homarr has a Race Condition in Invite Token Registration (TOCTOU)
CVSS 4.2
CVE-2026-27456 MEDIUM
util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
CVSS 4.7
CVE-2026-30332 HIGH
Balena Etcher for Windows <2.1.4 - Privilege Escalation
CVSS 7.5
CVE-2026-34452 MEDIUM
Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape
CVSS 5.3
CVE-2026-34224 MEDIUM
Parse Server: MFA single-use token bypass via concurrent authData login requests
CVSS 4.4
CVE-2026-32988 HIGH
OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation
CVSS 7.5
CVE-2026-32977 MEDIUM
OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path
CVSS 6.3
CVE-2026-32921 MEDIUM
OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run
CVSS 6.3
CVE-2026-25704 MEDIUM
Incomplete privilege drop for com.system76.CosmicGreeter.GetUserData
CVE-2026-33574 MEDIUM
OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download
CVSS 6.2
CVE-2026-32979 HIGH
OpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host Approval
CVSS 7.3
CVE-2026-33624 LOW
Parse Server: MFA recovery code single-use bypass via concurrent requests
CVSS 2.7
CVE-2026-23554 HIGH
Use after free of paging structures in EPT
CVSS 7.8
CVE-2026-32043 MEDIUM
OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter
CVSS 6.5
CVE-2026-31997 MEDIUM
OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals
CVSS 6.0
CVE-2026-27670 MEDIUM
OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition
CVSS 5.3
CVE-2026-32943 LOW
Parse Server has a password reset token single-use bypass via concurrent requests
CVSS 3.1
CVE-2026-27545 MEDIUM
OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind
CVSS 6.1
Details
Vulnerabilities 589
Exploit Likelihood Medium