Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-112938Medium· 5.8filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
CVE-2026-112910Medium· 5.3filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
CVE-2026-112908Medium· 5.3filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
CVE-2026-112909Medium· 6.1PoCfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
CVE-2026-112911Medium· 6.3PoCfilelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
CVE-2026-112912Low· 2.5PoCfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
CVE-2026-112915Medium· 5.5PoCfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
CVE-2026-112934Medium· 6.1PoCfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
CVE-2026-112935Medium· 4.7PoCfilelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
CVE-2026-112936Medium· 6.1PoCfilelock: ReadWriteLock follows a symlink at the lock path into SQLite
CVE-2026-112939Medium· 4.7PoCfilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
CVE-2026-112941Low· 3.3PoCfilelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
CVE-2026-112907Low· 2.5filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
CVE-2026-112913Low· 3.3filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
CVE-2026-112906Medium· 4.7PoCfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
CVE-2026-112937Medium· 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
CVE-2026-112940High· 7.1PoCfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2025-68146Medium· 6.3filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.