SecAlerts
t

tox-dev

Security Risk Profile

35
/100
low

Security Risk Score

Comprehensive risk assessment based on 15 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from December 16, 2025 to present

15
Total CVEs
1
Critical+High
0
Exploited
0
Unpatched

Threat Assessment

Avg CVSS
5.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
0
Critical/High
Risk Level
35/100
low
📈 13 in Last 30 Days

Severity Distribution

Critical
0
High
1
Medium
12
Low
2

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
1

Age Distribution

Common Weaknesses (CWE)

1
SQL Injection
4
2
Race Condition
3

Most Affected Products

1. ubuntu/python-filelock78
2. pip/filelock24
3. debian/python-filelock19
4. pypi/filelock15
5. tox-dev Filelock Python15

Recent Vulnerabilities

See more →
CVE-2026-112941
CVSS 3.3low

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

Oct 20, 2026
CVE-2026-112940
CVSS 7.1high

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

Oct 20, 2026
CVE-2026-112939
CVSS 4.7medium

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

Oct 20, 2026
CVE-2026-112937
CVSS 6.1medium

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

Oct 20, 2026
CVE-2026-112935
CVSS 4.7medium

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

Oct 20, 2026
CVE-2026-112906
CVSS 4.7medium

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

Oct 20, 2026
CVE-2026-112909
CVSS 6.1medium

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

Oct 20, 2026
CVE-2026-112934
CVSS 6.1medium

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

Oct 20, 2026
CVE-2026-112911
CVSS 6.3medium

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

Oct 20, 2026
CVE-2026-112914
CVSS 5.3medium

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

Oct 20, 2026

Monitor tox-dev in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.