CWE-367
CVEs classified under CWE-367, newest first.
335 CVEsRSS
CVE-2026-84018High· 7.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVE-2026-84009Medium· 4.7Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locally.
CVE-2026-83871High· 7.0Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVE-2026-83839High· 7.0Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-83834High· 7.0PoCUse after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-83750High· 7.0Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-83697Medium· 4.7Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
CVE-2026-83510High· 7.0Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVE-2026-83505High· 7.0Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVE-2026-83504Medium· 4.7Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
Time-of-check time-of-use (toctou) race condition in Windows SmartScreen allows an authorized attacker to disclose information locally.
CVE-2026-70288Medium· 5.5Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
CVE-2026-70122Medium· 6.5Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-70075Medium· 4.4Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
CVE-2026-108396High· 7.0Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-102832Medium· 4.2JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use trac…
CVE-2026-102672Medium· 6.7Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulner…
CVE-2026-108361High· 7.2Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successfu…
CVE-2026-108698Medium· 6.5hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest
hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registr…
CVE-2026-108741Low· 3.1Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attacker…
CVE-2026-73179High· 8.1Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurr…
Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurr…
CVE-2026-60091High· 7.2PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
CVE-2026-67693High· 7.5⚖ disputedAn issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
CVE-2026-61430High· 8.5PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
CVE-2026-107276Medium· 6.3MISP contains a race condition in the email-based one-time password (OTP) login flow
MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cau…
CVE-2026-103435High· 7.7Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap…
CVE-2026-106500High· 8.5Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated…
CVE-2026-101029Medium· 4.3Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to
Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileg…
CVE-2026-89430High· 8.1Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created
Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a b…
CVE-2026-106451High· 7.3yawkat LZ4 Java provides LZ4 compression for Java
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, th…
CVE-2026-106412High· 8.3Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a …
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a …