Docker CVEs
58 vulnerabilities mapped to Docker’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-105445 Docker Hub account conversion could reassign an active personal access token to another user
CVSS 9.4 criticalEPSS 0.43%
CVE-2026-106581 Docker Desktop for Windows installer failed to verify external packages
CVSS 8.2 highEPSS 0.08%
CVE-2026-101998 Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
CVSS 5.9 mediumEPSS 0.16%
CVE-2026-105570 Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
CVSS 6.7 mediumEPSS 0.13%
CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
CVSS 7.6 highEPSS 0.09%
CVE-2026-92542 Blind VXLAN injection into encrypted overlay networks from cluster peer
CVSS 6.9 mediumEPSS 0.07%
CVE-2026-93321 Malformed LLB file operation can crash buildkitd
CVSS 6.9 mediumEPSS 0.16%
CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps
CVSS 5.8 mediumEPSS 0.10%
CVE-2026-93326 Crafted Git build source can bypass certain policy validation
CVSS 6.0 mediumEPSS 0.25%
CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
CVSS 6.8 mediumEPSS 0.11%
CVE-2026-93322 Malformed MergeOp can crash the BuildKit daemon
CVSS 6.9 mediumEPSS 0.12%
CVE-2026-93320 BuildKit improperly handles special files in build snapshots
CVSS 6.0 mediumEPSS 0.11%
CVE-2026-93319 A malicious frontend can cause a daemon panic
CVSS 5.7 mediumEPSS 0.09%
CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs
CVSS 7.5 highEPSS 0.17%
CVE-2026-93317 Container blob cache can accept unverified content
CVSS 5.9 mediumEPSS 0.16%
CVE-2026-93316 Starting daemon with --cdi-disabled flag can lead to panic on specific builds
CVSS 7.1 highEPSS 0.23%
CVE-2026-55887 MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway
CVSS 8.7 highEPSS 0.22%
CVE-2026-18171 Docker Sandboxes read-only runtime mount writable through its shared-export alias
CVSS 5.7 mediumEPSS 0.14%
CVE-2026-15793 Git source checkout from a bundle file could lead to command injection
CVSS 7.5 highEPSS 0.20%
CVE-2026-15792 Possible panic when incorrect parameters sent from frontend
CVSS 7.5 highEPSS 0.24%
CVE-2026-15791 LLB file operation can be tricked to remove /tmp directory contents
CVSS 7.5 highEPSS 0.25%
CVE-2026-15788 WCOW cache mount source selector resolves NTFS junctions outside of cache root
CVSS 7.5 highEPSS 0.41%
CVE-2026-12539 Docker Sandboxes ICMP egress restriction bypass after daemon restart
CVSS 5.1 mediumEPSS 0.14%
CVE-2026-12039 Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
CVSS 5.7 mediumEPSS 0.10%
CVE-2026-42306 Moby: Race condition in docker cp allows bind mount redirection to host path
CVSS 7.2 highEPSS 0.10%
CVE-2026-41567 Docker: `PUT /containers/{id}/archive` executes container binary on the host
CVSS 7.2 highEPSS 0.16%
CVE-2026-6406 Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag
CVSS 8.8 highEPSS 0.21%
CVE-2026-33990 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
CVSS 9.1 criticalEPSS 0.25%
CVE-2026-33997 Moby: Off-by-one error in plugin privilege validation
CVSS 6.8 mediumEPSS 0.39%
CVE-2026-34040 Moby: AuthZ plugin bypass with oversized request body
CVSS 8.8 highEPSS 9.1%
CVE-2026-28400 Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint
CVSS 7.6 highEPSS 0.26%
CVE-2026-2664 Out of bounds read vulnerability in grpcfuse kernel module
CVSS 7.8 highEPSS 0.21%
CVE-2025-64443 DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode
CVSS 9.6 criticalEPSS 0.43%
CVE-2025-62725 Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations
CVSS 8.9 highEPSS 13.7%
CVE-2025-10657 Docker Desktop with ECI Fails to Enforce Socket Command Restrictions
CVSS 8.7 highEPSS 0.14%
CVE-2025-9074 Docker Desktop allows unauthenticated access to Docker Engine API from containers
CVSS 9.3 criticalEPSS 1.9%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)