Tox-Dev · weakness class
Race Conditions
9 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.
- filelock has TOCTOU race condition that allows symlink attacks during lock file creation
- filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
- filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
- filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
- filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
- filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
- filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
- filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
- filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.