Common Weakness Enumeration
CWE-367
AllowedTime-of-check Time-of-use (TOCTOU) Race Condition
Abstraction: Base · Status: Incomplete
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
626 vulnerabilities reference this CWE, most recent first.
CVE-2026-124622 (GCVE-0-2026-124622)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:45 – Updated: 2026-11-09 12:45 X_Open Source
VLAI
EPSS
VEX
Title
olivier-ls PHP-FTS Storage.php open toctou
Summary
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."
Severity
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433047 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433047/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124622 | third-party-advisory |
| https://vuldb.com/submit/1040549 | third-party-advisory |
| https://github.com/olivier-ls/php-fts/issues/3 | issue-tracking |
| https://github.com/olivier-ls/php-fts/commit/0b2f… | patch |
| https://github.com/olivier-ls/php-fts/releases/ta… | patch |
| https://github.com/olivier-ls/php-fts/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| olivier-ls | PHP-FTS |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Unaffected: 1.1.4 cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:*"
],
"product": "PHP-FTS",
"vendor": "olivier-ls",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "unaffected",
"version": "1.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: \"[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the \"Code Execution\" impact additionally assumes the symlink target is a web-served .php file.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:45:23.743Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433047 | olivier-ls PHP-FTS Storage.php open toctou",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433047"
},
{
"name": "VDB-433047 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433047/cti"
},
{
"name": "CVE-2026-124622 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124622"
},
{
"name": "Submit #1040549 | olivier-ls PHP-FTS V1.1.3 Link Following / TOCTOU",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040549"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/olivier-ls/php-fts/issues/3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/olivier-ls/php-fts/commit/0b2fae333d6b022da7ed4c43e2d41aa03f91dff3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/olivier-ls/php-fts/releases/tag/v1.1.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/olivier-ls/php-fts/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T08:02:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "olivier-ls PHP-FTS Storage.php open toctou",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124622",
"datePublished": "2026-11-09T12:45:23.743Z",
"dateReserved": "2026-11-09T06:57:28.604Z",
"dateUpdated": "2026-11-09T12:45:23.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123486 (GCVE-0-2026-123486)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-06 15:00
VLAI
EPSS
VEX
Title
WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php
Summary
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.
Severity
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/wwbn-avideo-… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "29.4.0",
"status": "affected",
"version": "29.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "29.4.0",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Vectrain51"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:48.677Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q77r-9mjq-mjw6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6"
},
{
"name": "VulnCheck Advisory: WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-paypal-ipn-deduplication-via-ipn-php"
}
],
"title": "WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123486",
"datePublished": "2026-11-06T15:00:48.677Z",
"dateReserved": "2026-11-06T00:44:37.658Z",
"dateUpdated": "2026-11-06T15:00:48.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123207 (GCVE-0-2026-123207)
Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-09 22:31
VLAI
EPSS
VEX
Title
LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding
Summary
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:31 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/LibreSpark/LibreTV/issues/941 | issue-tracking |
| https://github.com/LibreSpark/LibreTV/pull/960 | patchissue-tracking |
| https://github.com/LibreSpark/LibreTV/commit/cb42… | patch |
| https://github.com/LibreSpark/LibreTV/releases/ta… | release-notes |
| https://github.com/LibreSpark/LibreTV/blob/29cbeb… | technical-description |
| https://www.vulncheck.com/advisories/libretv-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LibreSpark | LibreTV |
Affected:
0 , < v2.21.2
(custom)
|
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:31:32.574881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:31:55.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/librespark/libretv",
"product": "LibreTV",
"repo": "https://github.com/LibreSpark/LibreTV",
"vendor": "LibreSpark",
"versions": [
{
"lessThan": "v2.21.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Gaoshou101"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:41.817Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/LibreSpark/LibreTV/issues/941"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/LibreSpark/LibreTV/pull/960"
},
{
"tags": [
"patch"
],
"url": "https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1"
},
{
"name": "LibreTV v2.21.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85"
},
{
"name": "VulnCheck Advisory: LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding"
}
],
"title": "LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123207",
"datePublished": "2026-11-05T18:16:41.817Z",
"dateReserved": "2026-11-05T17:58:52.271Z",
"dateUpdated": "2026-11-09T22:31:55.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123119 (GCVE-0-2026-123119)
Vulnerability from cvelistv5 – Published: 2026-11-05 12:57 – Updated: 2026-11-05 19:03
VLAI
EPSS
VEX
Title
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
Summary
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the resolve option so that the client connects to the exact IP that was checked. The issue is that resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.
An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 14:13 UTC
CWE
Assigner
Checkmarx
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://github.com/symfony/symfony/commit/ab08482… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
0 , < 5.4.56
(git)
Affected: 6.0.0 , < 6.4.50 (git) Affected: 7.0.0 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T14:13:38.399973Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:03:19.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-client",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HttpClient\\NoPrivateNetworkHttpClient"
],
"packageName": "symfony/http-client",
"product": "symfony",
"repo": "https://github.com/symfony/http-client",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "5.4.56",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"lessThan": "6.4.50",
"status": "affected",
"version": "6.0.0",
"versionType": "git"
},
{
"lessThan": "7.4.23",
"status": "affected",
"version": "7.0.0",
"versionType": "git"
},
{
"lessThan": "8.1.11",
"status": "affected",
"version": "8.0.0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eirik Stanghelle Morland from Packagist"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe Symfony HttpClient component\u0026nbsp;\u003ccode\u003eNoPrivateNetworkHttpClient\u003c/code\u003e\u0026nbsp;does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003eNoPrivateNetworkHttpClient\u003c/code\u003e resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the\u0026nbsp;\u003ccode\u003eresolve\u003c/code\u003e option so that the client connects to the exact IP that was checked. The issue is that\u0026nbsp;\u003ccode\u003eresolve\u003c/code\u003e\u003cspan\u003e was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003eAn attacker who controls a host\u0027s DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the\u0026nbsp;\u003ccode\u003eprimary_ip\u003c/code\u003e\u0026nbsp;in the\u0026nbsp;\u003ccode\u003eon_progress\u003c/code\u003e\u0026nbsp;callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.\u003c/div\u003e"
}
],
"value": "The Symfony HttpClient component\u00a0NoPrivateNetworkHttpClient\u00a0does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nNoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the\u00a0resolve option so that the client connects to the exact IP that was checked. The issue is that\u00a0resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.\n\nAn attacker who controls a host\u0027s DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the\u00a0primary_ip\u00a0in the\u00a0on_progress\u00a0callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T12:57:35.267Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-c7hm-wqwp-f9v8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/ab084826b2b5db8d0b91af635fe2b5e1c4f699f9"
}
],
"source": {
"advisory": "GHSA-c7hm-wqwp-f9v8",
"discovery": "UNKNOWN"
},
"title": "Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-123119",
"datePublished": "2026-11-05T12:57:35.267Z",
"dateReserved": "2026-11-05T12:32:19.431Z",
"dateUpdated": "2026-11-05T19:03:19.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122321 (GCVE-0-2026-122321)
Vulnerability from cvelistv5 – Published: 2026-11-05 02:25 – Updated: 2026-11-09 16:52
VLAI
EPSS
VEX
Title
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
Summary
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:10 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kyverno/kyverno/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/kyverno-1.18… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:10:07.534033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:52:39.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kyverno",
"vendor": "kyverno",
"versions": [
{
"lessThan": "1.19.2",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.19.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.2",
"versionStartIncluding": "1.18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "1seal"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T02:25:20.000Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2r43-6962-xcw5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-2r43-6962-xcw5"
},
{
"name": "VulnCheck Advisory: Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kyverno-1.18.0-before-1.19.2-verifyimages-cache-signature-verification-bypass"
}
],
"title": "Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122321",
"datePublished": "2026-11-05T02:25:20.000Z",
"dateReserved": "2026-11-04T23:26:08.934Z",
"dateUpdated": "2026-11-09T16:52:39.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119977 (GCVE-0-2026-119977)
Vulnerability from cvelistv5 – Published: 2026-10-31 05:33 – Updated: 2026-11-04 04:56
VLAI
EPSS
VEX
Title
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
Summary
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Severity
8.1 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 00:00 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
Wordfence
CNA
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WordPress Foundation | WordPress |
Affected:
4.7.0 , ≤ 4.7.38
(semver)
Affected: 4.8.0 , ≤ 4.8.33 (semver) Affected: 4.9.0 , ≤ 4.9.34 (semver) Affected: 5.0.0 , ≤ 5.0.30 (semver) Affected: 5.1.0 , ≤ 5.1.27 (semver) Affected: 5.2.0 , ≤ 5.2.29 (semver) Affected: 5.3.0 , ≤ 5.3.26 (semver) Affected: 5.4.0 , ≤ 5.4.24 (semver) Affected: 5.5.0 , ≤ 5.5.23 (semver) Affected: 5.6.0 , ≤ 5.6.22 (semver) Affected: 5.7.0 , ≤ 5.7.20 (semver) Affected: 5.8.0 , ≤ 5.8.18 (semver) Affected: 5.9.0 , ≤ 5.9.19 (semver) Affected: 6.0.0 , ≤ 6.0.17 (semver) Affected: 6.1.0 , ≤ 6.1.15 (semver) Affected: 6.2.0 , ≤ 6.2.14 (semver) Affected: 6.3.0 , ≤ 6.3.13 (semver) Affected: 6.4.0 , ≤ 6.4.13 (semver) Affected: 6.5.0 , ≤ 6.5.13 (semver) Affected: 6.6.0 , ≤ 6.6.10 (semver) Affected: 6.7.0 , ≤ 6.7.10 (semver) Affected: 6.8.0 , ≤ 6.8.11 (semver) Affected: 6.9.0 , ≤ 6.9.10 (semver) Affected: 7.0.0 , ≤ 7.0.7 (semver) Affected: 7.1.0 , ≤ 7.1.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119977",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-11-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T04:56:31.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "CVE-2026-119977 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WordPress",
"vendor": "WordPress Foundation",
"versions": [
{
"lessThanOrEqual": "4.7.38",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.8.33",
"status": "affected",
"version": "4.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.34",
"status": "affected",
"version": "4.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.30",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.27",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.29",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.3.26",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.24",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.5.23",
"status": "affected",
"version": "5.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.6.22",
"status": "affected",
"version": "5.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.7.20",
"status": "affected",
"version": "5.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.8.18",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.9.19",
"status": "affected",
"version": "5.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.17",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.15",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.14",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.13",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.13",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.13",
"status": "affected",
"version": "6.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.10",
"status": "affected",
"version": "6.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.7.10",
"status": "affected",
"version": "6.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.11",
"status": "affected",
"version": "6.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.10",
"status": "affected",
"version": "6.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.7",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Umut Bayram"
}
],
"descriptions": [
{
"lang": "en",
"value": "WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T05:33:07.059Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346"
},
{
"url": "https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545"
},
{
"url": "https://wordpress.org/news/2026/10/wordpress-7-1-4/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-119977",
"datePublished": "2026-10-31T05:33:07.059Z",
"dateReserved": "2026-10-30T17:17:35.145Z",
"dateUpdated": "2026-11-04T04:56:31.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119552 (GCVE-0-2026-119552)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
Summary
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/louislam/uptime-kuma/blob/2.5.… | technical-description |
| https://abraxaslabs.tech/research/uptime-kuma-set… | third-party-advisory |
| https://github.com/louislam/uptime-kuma | product |
| https://www.vulncheck.com/advisories/uptime-kuma-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| louislam | uptime-kuma |
Affected:
0 , ≤ 2.5.8
(semver)
cpe:2.3:a:uptime-kuma_project:uptime-kuma:*:*:*:*:*:*:*:* |
Date Public
2026-09-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:04.753408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:36.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/louislam/uptime-kuma",
"product": "uptime-kuma",
"repo": "https://github.com/louislam/uptime-kuma",
"vendor": "louislam",
"versions": [
{
"lessThanOrEqual": "2.5.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:uptime-kuma_project:uptime-kuma:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:03.438Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/louislam/uptime-kuma/blob/2.5.8/server/server.js#L705-L722"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/uptime-kuma-setup-toctou"
},
{
"tags": [
"product"
],
"url": "https://github.com/louislam/uptime-kuma"
},
{
"name": "VulnCheck Advisory: Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/uptime-kuma-through-2.5.8-race-condition-admin-creation-via-setup-handler"
}
],
"title": "Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119552",
"datePublished": "2026-10-30T11:31:03.438Z",
"dateReserved": "2026-10-30T10:53:26.670Z",
"dateUpdated": "2026-10-30T15:54:36.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119345 (GCVE-0-2026-119345)
Vulnerability from cvelistv5 – Published: 2026-11-05 15:53 – Updated: 2026-11-05 20:40
VLAI
EPSS
VEX
Title
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Summary
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:40 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ultravioletrs/cocos/security/a… | x_refsource_CONFIRM |
| https://github.com/ultravioletrs/cocos/pull/582 | x_refsource_MISC |
| https://github.com/ultravioletrs/cocos/commit/80b… | x_refsource_MISC |
| https://github.com/ultravioletrs/cocos/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ultravioletrs | cocos |
Affected:
< 0.9.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:40:34.478750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:40:45.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cocos",
"vendor": "ultravioletrs",
"versions": [
{
"status": "affected",
"version": "\u003c 0.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester\u0027s workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:53:42.702Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ultravioletrs/cocos/security/advisories/GHSA-ghwv-vrp2-2975",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ultravioletrs/cocos/security/advisories/GHSA-ghwv-vrp2-2975"
},
{
"name": "https://github.com/ultravioletrs/cocos/pull/582",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ultravioletrs/cocos/pull/582"
},
{
"name": "https://github.com/ultravioletrs/cocos/commit/80bf813c48300f02259b338b91f844c71be582ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ultravioletrs/cocos/commit/80bf813c48300f02259b338b91f844c71be582ea"
},
{
"name": "https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0"
}
],
"source": {
"advisory": "GHSA-ghwv-vrp2-2975",
"discovery": "UNKNOWN"
},
"title": "Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119345",
"datePublished": "2026-11-05T15:53:42.702Z",
"dateReserved": "2026-10-29T20:44:30.287Z",
"dateUpdated": "2026-11-05T20:40:45.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117603 (GCVE-0-2026-117603)
Vulnerability from cvelistv5 – Published: 2026-10-27 13:09 – Updated: 2026-11-02 16:01
VLAI
EPSS
VEX
Title
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Summary
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:01 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/spesmilo/electrum/security/adv… | vendor-advisory |
| https://github.com/spesmilo/electrum/commit/52223… | patch |
| https://github.com/spesmilo/electrum/commit/3956b… | patch |
| https://www.vulncheck.com/advisories/electrum-bef… | third-party-advisory |
Impacted products
Date Public
2026-04-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:01:12.487892Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:01:22.924Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "electrum",
"vendor": "spesmilo",
"versions": [
{
"lessThan": "4.7.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:electrum:electrum:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "maru1009"
}
],
"datePublic": "2026-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:09:52.728Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q7m2-785w-r585)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5"
},
{
"name": "VulnCheck Advisory: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass"
}
],
"title": "Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-117603",
"datePublished": "2026-10-27T13:09:52.728Z",
"dateReserved": "2026-10-27T13:04:09.906Z",
"dateUpdated": "2026-11-02T16:01:22.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116250 (GCVE-0-2026-116250)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:55 – Updated: 2026-11-06 16:18
VLAI
EPSS
VEX
Title
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
Summary
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths.
Exploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race.
The fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path.
This issue affects pgAdmin 4: before 9.19.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:17 UTC
CWE
Assigner
PostgreSQL
CNA
References
4 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pgadmin.org | pgAdmin 4 |
Affected:
0 , < 9.19
(custom)
|
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116250",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:17:53.650844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:18:17.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"File Manager",
"Import/Export Servers",
"Backup",
"Restore",
"Import/Export Data"
],
"product": "pgAdmin 4",
"programFiles": [
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/file_manager/__init__.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py",
"https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export_servers/__init__.py"
],
"repo": "https://github.com/pgadmin-org/pgadmin4",
"vendor": "pgadmin.org",
"versions": [
{
"lessThan": "9.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MUTED CYBERSECURITY S.L. \u003ccybersec@mut3dcybersecurity.com\u003e"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dave Page \u003cdpage@pgadmin.org\u003e"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Hitesh Jambhale \u003chitesh.jambhale@enterprisedb.com\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Hitesh Jambhale \u003chitesh.jambhale@enterprisedb.com\u003e"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Ashesh Vashi \u003cashesh.vashi@enterprisedb.com\u003e"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager\u0027s save_file; these were the remaining paths.\n\nExploitation requires creating such a link or FIFO inside the user\u0027s storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race.\n\nThe fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path.\n\nThis issue affects pgAdmin 4: before 9.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Threat model: an operating-system user other than the pgAdmin service account who can write into a storage directory pgAdmin uses (a shared or network-mounted storage backend), and who also has, or works with, a pgAdmin account using it. An attacker with access to the host as the service account gains nothing from this flaw, so the Attack Vector is Local. Attack Complexity is High: the link must be planted and a race between the check and the open won. Confidentiality and Integrity are High because a file readable or writable by the pgAdmin account can be read (including loaded into a table) or overwritten; Availability is Low for a clobbered file or a hung request. Scope is Unchanged: the operations run with the authority pgAdmin already holds."
}
]
},
{
"cvssV4_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Same reasoning as the CVSS 3.1 entry. AT:P for the race and for the write access to the storage backend obtained outside pgAdmin. VC:H/VI:H/VA:L as above; no subsequent-system impact."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:55:18.713Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/pgadmin-org/pgadmin4/issues/10647"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/99f5606e2ebc7c94c7acdbab877ce7de54bfc756"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/c4321b9968342716f34bc5f10de6cac3c0567e68"
},
{
"tags": [
"patch"
],
"url": "https://github.com/pgadmin-org/pgadmin4/commit/730d1e783c339ec696a1f77f2eee6f4b52cb6c37"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check"
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116250",
"datePublished": "2026-10-30T19:55:18.713Z",
"dateReserved": "2026-10-25T16:26:16.420Z",
"dateUpdated": "2026-11-06T16:18:17.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Mitigation
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Mitigation
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
Mitigation
Implementation
Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
Mitigation
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
Mitigation
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
Mitigation
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
CAPEC-27: Leveraging Race Conditions via Symbolic Links
This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.