CVE-2026-112911

mediumPriorität · verfolgen · 0EPSS 0.001 · 4. PerzentilUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.15% (4th) EPSS

CVSS 6.3 · medium

Is it mine?

1 products

Prüfe deine Angriffsfläche

Who says so?

1 sources

nvd

EPSS · bewertet 2026-10-27

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.3mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 1 · Auswirkung 5.2

v3.15.8mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-283USprimär

betroffene Produkte (1)

Betroffene Produkte und Versionsbereiche.

tox-dev filelock3.30.0 → 4.2.1nvdUScpe:2.3:a:tox-dev:filelock:*:*:*:*:*:*:*:*

quellen

Welche Quellen diesen Datensatz belegen und wann.

nvd NVD CVE.org MITRE

veröffentlicht 2026-10-20geändert 2026-10-21

verwandt (36)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-27903US	critical9.8	8.92% (95th)	—	2024-07-08
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact w…
CVE-2019-9010US	critical9.8	1.90% (80th)	—	2019-08-15
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODES…
CVE-2020-8554US	medium5.0	8.72% (95th)	Exploit	2021-01-21
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Addit…
CVE-2026-26016US	high8.1	0.36% (30th)	—	2026-02-19
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers…
CVE-2021-24501US	high8.1OT erhöht	1.25% (69th)	—	2021-08-09
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifyin…

+31 weitere

Referenzen (4) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03Patch
https://github.com/tox-dev/filelock/pull/839Patch
https://github.com/tox-dev/filelock/releases/tag/4.2.1Release Notes
https://github.com/tox-dev/filelock/security/advisories/GHSA-9c4x-gm8v-wgc4ExploitMitigationPatchVendor Advisory

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan