CISA adds WordPress Core TOCTOU flaw to KEV
CISA confirms active exploitation of CVE-2026-119977 allowing unauthenticated code execution during upgrades.
Stories per day · 30 days
1 RSS
Relatedcisa3kev3wordpress3apache-tomcat1apr1cve-2026-580941freebsd1kernel1local-access1local-privilege-escalation1unix-domain-socket1zdi1
15 stories, newest first · one card per story
Stories tagged #toctou
CISA adds WordPress TOCTOU vulnerability to KEV Catalog
CISA adds CVE-2026-119977, a TOCTOU race condition in WordPress Core, to KEV Catalog based on active exploitation.
CISA KEV: WordPress Core TOCTOU race condition CVE-2026-119977
WordPress Core upgrade TOCTOU vulnerability enables unauthenticated code execution during staging.
Tomcat APR sockets still exposed by TOCTOU after earlier fix
An unauthorised local user can reach the APR/Native Unix domain socket on Tomcat 9.0.47 through 9.0.122.
ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI disclosed FreeBSD kernel shared-memory TOCTOU bug CVE-2026-58094 enabling local privilege escalation.
Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads
Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.
7
ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI discloses a Windows dxgkrnl time-of-check time-of-use bug enabling local privilege escalation.
The GNU C Library security advisories update for 2026-09-22
A glibc ld.so TOCTOU lets local attackers load code via $ORIGIN in setuid programs.
Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files
Docker fixed two symlink-race flaws in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, letting malicious guests escape the workspace and read host files; fixed in 0.42.0.
4
CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.
Compiler Can Undo Your Security Checks
Chris Domas explains at Black Hat how legal compiler optimizations can strip security checks and memory-clearing operations, turning secure C source into vulnerable binaries.
ZDI-26-652: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI-26-652: TOCTOU race in Trend Micro Apex One cache mechanism, CVE-2025-71416, enables local privilege escalation, rated CVSS 7.8.
Vulnerability fixes in util-linux-2.42.3
util-linux 2.42.3 patches mount(8) flaws CVE-2026-76642 and CVE-2026-78410, which allow privileged operations after mount helper failure.
Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists
Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.
ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI publishes ZDI-26-575, a CVSS 7.5 TOCTOU local privilege escalation in the Linux kernel net scheduler packet classifier API.