Weaknesses of type CWE-367

680 results

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: permissão, existência de arquivo) e depois usa o recurso baseado naquela verificação, mas entre os dois momentos outro processo pode mudar o estado do recurso. O atacante explora a janela de tempo para alterar o que foi verificado, contornando a validação.

Example

Um programa verifica se um arquivo existe e tem permissão de leitura, depois o abre para processar. Entre a verificação e a abertura, um atacante pode trocar o arquivo por um link simbólico apontando para um arquivo sensível do sistema. O programa abre o link sem perceber a mudança.

How to mitigate

Use operações atômicas que combinam verificação e uso em uma única chamada de sistema (ex: open() com flags exclusivas, fstat() após abrir arquivo). Em casos de acesso a dados compartilhados, implemente locks ou transações que impeçam alterações entre a validação e o uso do recurso.

CVE-2026-25536HIGH@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseEPSS 0.3%CVE-2025-3599MEDIUMSymantec Endpoint Protection Elevation of PrivilegeEPSS 0.3%CVE-2023-24861HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-33156MEDIUMMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2021-34986HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). An attacker EPSS 0.3%CVE-2026-91712HIGHRace condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer prEPSS 0.3%CVE-2024-6787MEDIUMMXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race ConditionEPSS 0.3%CVE-2021-0289MEDIUMJunos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restartedEPSS 0.3%CVE-2026-79155HIGHRace condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to pEPSS 0.3%CVE-2026-79071HIGHRace condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentiaEPSS 0.3%CVE-2026-56676HIGH9router: Image prefetch DNS rebinding allows SSRF to internal servicesEPSS 0.3%CVE-2025-32784HIGHconda-forge-webservices has an Unauthorized Artifact Modification Race ConditionEPSS 0.3%CVE-2015-1865MEDIUMfts.c in coreutils 8.4 allows local users to delete arbitrary files.EPSS 0.3%CVE-2023-23389MEDIUMMicrosoft Defender Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-23950HIGHnode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSEPSS 0.3%CVE-2020-8354MEDIUMA potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrEPSS 0.3%CVE-2026-57959HIGHHi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race ConditionEPSS 0.3%CVE-2026-47621MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationEPSS 0.3%CVE-2026-16967HIGHIBM i is Affected By Multiple SQL Vulnerabilities [, ]EPSS 0.3%CVE-2026-58041MEDIUMA flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cacEPSS 0.3%