recorded together · two weakness classes
Race Conditions and File and Path Handling
68 CVEs
68 CVEs name a weakness of both Race Conditions and File and Path Handling, fewer than chance alone would give (about 106). The pairing most often behind it is CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) with CWE-59 (Link Following), in 32 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 68
- Chance alone would give
- about 106
- So they are recorded together
- less often than chance (0.6×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
Every one of the 68 is a mark on the map. Named now: 1 to 26, most at risk first.
- Launch Services in Apple Mac OS X before 10.5, when Open Safe Files is enabled, allows remote attackers to execute arbitrary code via a symlink attack, probably related to a race…
- A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed.…
- runc container escape via "masked path" abuse due to mount race conditions
- Unspecified vulnerability in pprosetup in Sun PatchPro 2.0 has unknown impact and attack vectors related to "unsafe use of temporary files."
- The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges via a symlink attack on the updater binary itself.
- Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain ro…
- APT RCE via hard link reuse
CWE-62Debian5 articles1 article this week: OpenSSH flaw allows passwordless logins on musl systems
- OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race co…
- container escape due to /dev/console mount and related races
- Data Sharing Service Spoofing Vulnerability
- runc: LSM labels can be bypassed with malicious config using dummy procfs files
- AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The…
- Improper isolation of server file access in github.com/pterodactyl/wings
- Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server
- Perl threads have a working directory race condition where file operations may target unintended paths
- OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
- Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Plat…
- Backstage: Improper task state validation in Scaffolder backend
- A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended uplo…
- A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-…
- pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check
- Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
- runc can be confused to create empty files/directories on the host
- Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissio…
- rsync < 3.5.0 Symlink Race Condition Directory Traversal
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.