TO
Vendor
tox-dev
15
CVEs
0
On KEV
13
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112941 | FI filelock tox-dev | 3.3 | Oct 20 | filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock |
| CVE-2026-112940 | FI filelock tox-dev | 7.1 | Oct 20 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files |
| CVE-2026-112939 | FI filelock tox-dev | 4.7 | Oct 20 | filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker |
| CVE-2026-112937 | FI filelock tox-dev | 6.1 | Oct 20 | filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name |
| CVE-2026-112936 | FI filelock tox-dev | 6.1 | Oct 20 | filelock: ReadWriteLock follows a symlink at the lock path into SQLite |
| CVE-2026-112935 | FI filelock tox-dev | 4.7 | Oct 20 | filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders |
| CVE-2026-112934 | FI filelock tox-dev | 6.1 | Oct 20 | filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record |
| CVE-2026-112915 | FI filelock tox-dev | 5.5 | Oct 20 | filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout |
| CVE-2026-112914 | FI filelock tox-dev | 5.3 | Oct 20 | filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory |
| CVE-2026-112912 | FI filelock tox-dev | 2.5 | Oct 20 | filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker |
| CVE-2026-112911 | FI filelock tox-dev | 6.3 | Oct 20 | filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion |
| CVE-2026-112909 | FI filelock tox-dev | 6.1 | Oct 20 | filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path |
| CVE-2026-112906 | FI filelock tox-dev | 4.7 | Oct 20 | filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse |
| CVE-2026-22701 | FI filelock tox-dev | 5.3 | Jan 10 | filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock |
| CVE-2025-68146 | FI filelock tox-dev | 6.5 | Dec 16 | filelock has TOCTOU race condition that allows symlink attacks during lock file creation |