CWE-363 · 8 records
Race Condition Enabling Link Following
CVEs in this class
8 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
28Monitor | CVE-2026-112940No exploit | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its owntox-dev · filelock · CWE-363 | High7.1 | — | 0.1% | Oct 20, 2026 |
25Monitor | CVE-2022-21658Proof of concept | Race condition in std::fs::remove_dir_all in rustlangrust-lang · rust · CWE-363 | Medium6.3 | — | 1.3% | Jan 20, 2022 |
24Monitor | CVE-2026-71125No exploit | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).oracle · vm virtualbox · CWE-363 | Medium6.1 | — | 0.1% | Aug 18, 2026 |
24Monitor | CVE-2026-91203No exploit | Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race conditionred hat · red hat enterprise linux 10 · CWE-363 | Medium6.0 | — | 0.1% | Sep 18, 2026 |
24Monitor | CVE-2026-91205No exploit | Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink racered hat · red hat enterprise linux 10 · CWE-363 | Medium6.0 | — | 0.1% | Sep 18, 2026 |
23Monitor | GHSA-m462-7rxw-wvpgNo exploit | filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesCWE-363 | Medium5.8 | — | — | 2 days ago |
21Monitor | CVE-2026-112914No exploit | filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directorytox-dev · filelock · CWE-363 | Medium5.3 | — | 0.1% | Oct 20, 2026 |
21Monitor | CVE-2025-13492No exploit | HP Image Assistant - Potential Escalation of Privilegehp · image assistant · CWE-363 | Medium5.4 | — | 0.0% | Dec 3, 2025 |
- CVE-2026-11294028Monitor
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own
HighCVSS 7.1No exploitEPSS 0%tox-dev · filelockOct 20, 2026
- CVE-2022-2165825Monitor
Race condition in std::fs::remove_dir_all in rustlang
MediumCVSS 6.3Proof of conceptEPSS 1%rust-lang · rustJan 20, 2022
- CVE-2026-7112524Monitor
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).
MediumCVSS 6.1No exploitEPSS 0%oracle · vm virtualboxAug 18, 2026
- CVE-2026-9120324Monitor
Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition
MediumCVSS 6.0No exploitEPSS 0%red hat · red hat enterprise linux 10Sep 18, 2026
- CVE-2026-9120524Monitor
Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race
MediumCVSS 6.0No exploitEPSS 0%red hat · red hat enterprise linux 10Sep 18, 2026
- GHSA-m462-7rxw-wvpg23Monitor
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
MediumCVSS 5.8No exploit2 days ago
- CVE-2026-11291421Monitor
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
MediumCVSS 5.3No exploitEPSS 0%tox-dev · filelockOct 20, 2026
- CVE-2025-1349221Monitor
HP Image Assistant - Potential Escalation of Privilege
MediumCVSS 5.4No exploitEPSS 0%hp · image assistantDec 3, 2025