filelock vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-112941Lowfilelock: filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user…CVE-2026-112908Mediumfilelock: filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a…CVE-2026-112911Mediumfilelock: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionCVE-2026-112910Mediumfilelock: filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLCVE-2026-112915Mediumfilelock: filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutCVE-2026-112939Mediumfilelock: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerCVE-2026-112912Lowfilelock: filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerCVE-2026-112909Mediumfilelock: filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathCVE-2026-112936Mediumfilelock: filelock: ReadWriteLock follows a symlink at the lock path into SQLiteCVE-2026-112938Mediumfilelock: filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local…CVE-2026-112934Mediumfilelock: filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its…CVE-2026-112935Mediumfilelock: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersCVE-2026-112937Mediumfilelock: filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory nameCVE-2026-112913Lowfilelock: filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databaseCVE-2026-112907Lowfilelock: filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breakCVE-2026-112906Mediumfilelock: filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuseCVE-2026-112914Mediumfilelock: filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…CVE-2026-112940Highfilelock: filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process…CVE-2026-22701Mediumfilelock: filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2025-68146Mediumfilelock: filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo