CWE-367 in Race Conditions
- CVEs
- 911
- Exploited
- 7
- Public check
- 1
- Likely
- 11
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-11775All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there… | The Eclipse Foundation · Eclipse OpenJ9 | Possible | – | 1.5% | 2019-07-30 |
| CVE-2020-25860The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes… | Pengutronix · Pengutronix RAUC | Possible | – | 1.4% | 2020-12-21 |
| CVE-2020-3808Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use (toctou) race condition vulnerability. Successful exploitation could lead to arbitr… | Adobe · Creative Cloud Desktop Application | Possible | – | 1.4% | 2020-03-25 |
| CVE-2024-29066Windows Distributed File System (DFS) Remote Code Execution Vulnerability | Microsoft · Windows Server 2019 | Possible | 7.2 | 1.3% | 2024-04-09 |
| CVE-2022-44670Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Microsoft · Windows 10 Version 1809 | Possible | 8.1 | 1.2% | 2022-12-13 |
| CVE-2020-8562Bypass of Kubernetes API Server proxy TOCTOU | Kubernetes · Kubernetes | Possible | 2.2 | 1.2% | 2022-02-01 |
| CVE-2021-42835An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RP… | Plex · Media Server | Possible | – | 1.2% | 2021-12-08 |
| CVE-2025-29969MS-EVEN RPC Remote Code Execution Vulnerability | Microsoft · Windows 10 Version 1507 | Possible | 7.5 | 1.2% | 2025-05-13 |
| CVE-2019-1065Windows Kernel Elevation of Privilege Vulnerability | Microsoft · Windows 10 Version 1803 | Possible | 7.8 | 1.2% | 2019-06-12 |
| CVE-2026-32093Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability | Microsoft · Windows 10 Version 1607 | Possible | 7.0 | 1.2% | 2026-04-14 |
| CVE-2023-29337NuGet Client Remote Code Execution Vulnerability | Microsoft · NuGet 6.2.3 | Possible | 7.1 | 1.1% | 2023-06-14 |
| CVE-2021-46853Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS. | Alpine Project · Alpine | Possible | 5.9 | 1.1% | 2022-11-03 |
| CVE-2022-28743Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, and Application FW <= 2.91.2.66, allows an authenticated remo… | Foscam · R2c Application Firmware | Possible | 9.1 | 1.1% | 2022-04-21 |
| CVE-2024-41787IBM Engineering Requirements Management DOORS Next code execution | IBM · Engineering Requirements Management DOORS Next | Possible | 9.8 | 1.1% | 2025-01-10 |
| CVE-2020-8890An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a br… | Misp-Project · Misp | Possible | – | 1.1% | 2020-02-11 |
| CVE-2026-53822OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution | OpenClaw · OpenClaw | Possible | 8.8 | 1.1% | 2026-06-12 |
| CVE-2018-16872A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn… | Qemu · QEMU: | Possible | 5.0 | 1.1% | 2018-12-13 |
| CVE-2023-21555Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability | Microsoft · Windows 10 Version 1809 | Possible | 8.1 | 1.1% | 2023-01-10 |
| CVE-2024-28718An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component. | Openstack · Magnum | Possible | 9.8 | 1.1% | 2024-04-12 |
| CVE-2021-22043VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit… | Vmware · VMware ESXi and VMware Cloud Foundation | Possible | – | 1.1% | 2022-02-16 |
| CVE-2013-3888dxgkrnl.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted ap… | Microsoft · Windows 7 | Possible | 8.4 | 1.0% | 2013-10-09 |
| CVE-2019-5519VMware ESXi (6.7 before ESXi670-201903001, 6.5 before ESXi650-201903001, 6.0 before ESXi600-201903001), Workstation (15.x before 15.0.4, 14.x before 14.1.7), Fusion (11.x before 1… | VMware · VMware ESXi, Workstation, Fusion | Possible | – | 1.0% | 2019-04-01 |
| CVE-2017-0756A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID:… | Google Inc. · Android | Unlikely | – | 1.0% | 2017-09-08 |
| CVE-2019-19793In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges. | Cyxtera · Appgate Sdp | Unlikely | – | 1.0% | 2019-12-13 |
| CVE-2021-3054PAN-OS: Unsigned Code Execution During Plugin Installation Race Condition Vulnerability | Palo Alto Networks · PAN-OS | Unlikely | 7.2 | 0.9% | 2021-09-08 |
| CVE-2019-7347A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users ta… | Zoneminder · Zoneminder | Unlikely | – | 0.9% | 2019-02-04 |
| CVE-2026-19118Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution | GitHub · Enterprise Server | Unlikely | 7.7 | 0.9% | 2026-09-01 |
| CVE-2021-21615Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condi… | Jenkins project · Jenkins | Unlikely | – | 0.9% | 2021-01-26 |
| CVE-2021-23977Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories. Note: This is… | Mozilla · Firefox | Unlikely | – | 0.9% | 2021-02-26 |
| CVE-2020-35889An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike. | Crayon Project · Crayon | Unlikely | – | 0.9% | 2020-12-31 |
| CVE-2020-8793OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race co… | Opensmtpd · Opensmtpd | Unlikely | – | 0.9% | 2020-02-25 |
| CVE-2024-48322UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. | – | Unlikely | 8.1 | 0.9% | 2024-11-11 |
| CVE-2024-38186Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | Microsoft · Windows 10 Version 1809 | Unlikely | 7.8 | 0.8% | 2024-08-13 |
| CVE-2020-3982VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-… | Vmware · VMware ESXi, Workstation, Fusion | Unlikely | – | 0.8% | 2020-10-20 |
| CVE-2024-41779IBM Engineering Systems Design Rhapsody - Model Manager | IBM · Engineering Systems Design Rhapsody - Model Manager | Unlikely | 9.8 | 0.8% | 2024-11-22 |
| CVE-2019-1380A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. | Microsoft · Windows Server | Unlikely | – | 0.8% | 2019-11-12 |
| CVE-2023-23520A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read… | Apple · iOS and iPadOS | Unlikely | 5.9 | 0.8% | 2023-02-27 |
| CVE-2020-13162A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM)… | Pulsesecure · Pulse Secure Desktop Client | Unlikely | 7.0 | 0.8% | 2020-06-16 |
| CVE-2023-33154Windows Partition Management Driver Elevation of Privilege Vulnerability | Microsoft · Windows 10 Version 1809 | Unlikely | 7.8 | 0.8% | 2023-07-11 |
| CVE-2026-21523GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability | Microsoft · Microsoft Visual Studio Code CoPilot Chat Extension | Unlikely | 8.0 | 0.8% | 2026-02-10 |
| CVE-2022-4143An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, una… | GitLab · GitLab | Unlikely | 6.4 | 0.8% | 2023-06-28 |
| CVE-2024-29062Secure Boot Security Feature Bypass Vulnerability | Microsoft · Windows 10 Version 1809 | Unlikely | 7.1 | 0.7% | 2024-04-09 |
| CVE-2023-38041A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploi… | Ivanti · Secure Access Client | Unlikely | 7.8 | 0.7% | 2023-10-25 |
| CVE-2022-23029On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is configured on a virt… | F5 · BIG-IP | Unlikely | – | 0.7% | 2022-01-25 |
| CVE-2017-0331An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issu… | Google · Android | Unlikely | – | 0.7% | 2017-05-02 |
| CVE-2025-49730Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability | Microsoft · Windows 10 Version 1507 | Unlikely | 7.8 | 0.7% | 2025-07-08 |
| CVE-2022-24335JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. | Jetbrains · Teamcity | Unlikely | – | 0.7% | 2022-02-25 |
| CVE-2020-7460In FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4-RELEASE before p2, and 11.3-RELEASE before p12, the sendmsg system call in the comp… | Freebsd · FreeBSD | Unlikely | – | 0.7% | 2020-08-06 |
| CVE-2022-23181Local privilege escalation with FileStore | Apache Software Foundation · Apache Tomcat | Unlikely | – | 0.7% | 2022-01-27 |
| CVE-2019-11774Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is… | The Eclipse Foundation · Eclipse OMR | Unlikely | – | 0.7% | 2019-09-12 |
Data as of 2026-11-15.