Skip to content
BackEsc
Sign in

CWE-367 · weakness in Race Conditions

Time-of-check Time-of-use (TOCTOU) Race Condition

911 CVEs · 7 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
7
check available
1
likely to be exploited
11

Every one of the 911 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Windows Kernel Elevation of Privilege VulnerabilityCVE-2024-30088Microsoft · CVSS 7 · 68% likely

    MicrosoftOilRig

  2. Microsoft Outlook Security Feature Bypass VulnerabilityCVE-2023-35311Microsoft · CVSS 8.8 · 16% likely

    Microsoft

  3. libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a deni…CVE-2015-3246Red Hat · CVSS 7.4 · 8.5% likelycovered by CyberSIXT

    Red Hat5 articles

  4. VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privilege…CVE-2025-22224VMware · CVSS 9.3 · 1.6% likelycovered by CyberSIXT

    VMware

  5. posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352Linux · CVSS 7.8 · 1.4% likely

    Linux

  6. WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionCVE-2026-119977WordPress Foundation · CVSS 8.1 · 1.2% likelycovered by CyberSIXT

    WordPress4 articles

  7. The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and writ…CVE-2022-48618Apple · CVSS 7 · 0.5% likely

    Apple

  8. Versa Concerto API Path Based - Authentication BypassCVE-2025-34027Versa · CVSS 10 · 46% likely

    Versa

  9. This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this v…CVE-2022-36980Ivanti · CVSS 9.4 · 82% likely

    Ivanti

  10. The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execut…CVE-2004-059455% likely
  11. NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container…CVE-2024-0132NVIDIA · CVSS 9 · 41% likely

    NVIDIA

  12. Windows Themes Remote Code Execution VulnerabilityCVE-2023-38146Microsoft · CVSS 8.8 · 37% likely

    Microsoft

  13. Apache Tomcat: RCE due to TOCTOU issue in JSP compilationCVE-2024-50379Apache Software Foundation · CVSS 9.8 · 32% likely

    Apache

  14. Windows Registry Elevation of Privilege VulnerabilityCVE-2024-43452Microsoft · CVSS 7.5 · 30% likely

    Microsoft

  15. A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by c…CVE-2003-081317% likely
  16. Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2020-1337Microsoft · CVSS 7.8 · 14% likelycovered by CyberSIXT

    MicrosoftCitrus Ransomware1 article1 article this week: Citrus ransomware uses contractor access to breach networks

  17. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a differe…CVE-2015-174314% likely
  18. Windows Kernel Elevation of Privilege VulnerabilityCVE-2024-26218Microsoft · CVSS 7.8 · 13% likely

    Microsoft

  19. Windows Kernel Elevation of Privilege VulnerabilityCVE-2024-21371Microsoft · CVSS 7 · 11% likely

    Microsoft

  20. Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteCVE-2024-56337Apache Software Foundation · CVSS 9.8 · 9.0% likely

    Apache

  21. An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that…CVE-2019-151267.3% likely
  22. OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge WritesCVE-2026-44112OpenClaw · CVSS 9.6 · 7.3% likelycovered by CyberSIXT

    OpenClaw

  23. A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between the scripts being disc…CVE-2022-29800networkd-dispatcher · CVSS 4.7 · 7.2% likely
  24. Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityCVE-2024-30084Microsoft · CVSS 7 · 5.9% likely

    Microsoft

  25. Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2024-21433Microsoft · CVSS 7 · 5.1% likely

    Microsoft

  26. An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE…CVE-2019-0836Microsoft · 4.3% likely

    Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in