CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Ghost: Server-Side Request Forgery in Bookmark Fetching

PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Electron: Local race condition in Squirrel.Mac update installation on macOS

9router: Image prefetch DNS rebinding allows SSRF to internal services

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

ONNX: TOCTOU arbitrary file read/write in save_external_dat

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

OpenClaw: Node pairing reconnection could confuse approval scope state

Duplicate Advisory: OpenClaw: Node pairing reconnection could confuse approval scope state

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

Duplicate Advisory: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)