CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,189 CVEs published, 238 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,189
Show in the list
Critical, last 7 days
238
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product tox-dev:filelock. Show all products

15 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-112941Low 3.3filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112940High 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112939Medium 4.7filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112937Medium 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112936Medium 6.1filelock: ReadWriteLock follows a symlink at the lock path into SQLite
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112935Medium 4.7filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112934Medium 6.1filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112915Medium 5.5filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112914Medium 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
Assigned by GitHub_M
Oct 20, 2026
CVE-2026-112912Low 2.5filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
Assigned by GitHub_M
Oct 20, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.