ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “toctou”

51 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 27Exploit / PoC 18Advisory 3Ransomware 2Industry 1Policy & legal 1
SeverityAllcritical 29high 8medium 12low 3info 0

Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.

Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.

Full Disclosure · 11d agoVulnerability

ZDI-26-653: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

ZDI-26-653: TOCTOU race in Trend Micro Apex One cache mechanism, CVE-2025-71415, enables local privilege escalation, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-653 for the Trend Micro Apex One Security Agent. A time-of-check time-of-use (TOCTOU) flaw in the cache mechanism, tracked as CVE-2025-71415, allows local attackers to escalate privileges after gaining low-privileged code execution. ZDI assigned a CVSS 7.8 rating. A vendor patch is available for affected installations.

ZDI Published Advisories · 5d agoAdvisory 3 sourcesCVE-2025-71415

ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-575, a CVSS 7.5 TOCTOU local privilege escalation in the Linux kernel net scheduler packet classifier API.

The Zero Day Initiative disclosed a time-of-check time-of-use flaw in the Linux kernel's net scheduler packet classifier API that permits local privilege escalation. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5; no CVE id is provided in the text.

ZDI Published Advisories · Aug 13, 2026Advisory1

Vulnerability fixes in util-linux-2.42.3

util-linux 2.42.3 patches mount(8) flaws CVE-2026-76642 and CVE-2026-78410, which allow privileged operations after mount helper failure.

util-linux 2.42.3 ships security fixes for two mount(8) vulnerabilities. CVE-2026-76642 causes post-mount hooks (X-mount.idmap, X-mount.owner/group/mode) to run even when an external mount helper exits nonzero, permitting privileged operations on the pre-existing target filesystem. CVE-2026-78410 is a time-of-check-to-time-of-use (TOCTOU) issue in mount(8). No exploitation or PoC is mentioned in the release notes.

oss-security · 11d agoVulnerabilityCVE-2026-76642CVE-2026-78410