Priority HIGH 66
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.0044 · Published 2026-08-18 · Partial fix · 0.3.0, 0.38.0 +3 CWE-59
Priority MEDIUM 64
HyperKit is a toolkit for embedding hypervisor capabilities in an application.
CVSS 3.1HIGH 7.1· Local · No auth · No interaction · EPSS 0.00369 · Published 2023-02-20 · No fix listed CWE-125
Priority MEDIUM 59
Moby is an open-source project created by Docker for software containerization.
CVSS 3.1CRITICAL 10.0· Network · Low privileges · No interaction · EPSS 0.16496 · Published 2024-07-24 · Partial fix · 23.0.15, 26.1.5 +2 CWE-187
Priority MEDIUM 55
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03446 · Published 2024-01-31 · Fixed in 0.12.5 CWE-863
Priority MEDIUM 54
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.02464 · Published 2024-01-31 · Fixed in 0.12.5 CWE-22
Priority MEDIUM 52
Moby is an open source container framework.
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.0927 · Published 2026-03-31 · Partial fix · 29.3.1, 2.0.0-beta.8 CWE-288
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00656 · Published 2026-04-16 · Partial fix · 0.5.1 CWE-770
Priority MEDIUM 43
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00507 · Published 2026-03-27 · Partial fix · 0.28.1 CWE-22
Priority MEDIUM 42
Moby is an open source container framework developed by Docker Inc.
CVSS 3.1HIGH 8.7· Network · No auth · No interaction · EPSS 0.02559 · Published 2023-04-04 · Fixed in 20.10.24, 23.0.3 CWE-420
Priority MEDIUM 41
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 3.1HIGH 8.7· Network · No auth · No interaction · EPSS 0.00911 · Published 2024-01-31 · Partial fix · 0.12.5 CWE-362
Priority MEDIUM 40
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 4.0HIGH 7.2· Network · Low privileges · No interaction · EPSS 0.00541 · Published 2026-08-19 · Partial fix · 0.31.2 CWE-22
Priority LOW 37
Moby is an open source container framework.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00402 · Published 2026-03-31 · Partial fix · 29.3.1, 2.0.0-beta.8 CWE-193
Priority LOW 36
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00481 · Published 2026-03-27 · Partial fix · 0.28.1 CWE-22
Priority LOW 36
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00744 · Published 2024-03-20 · Fixed in 26.0.0-rc3, 25.0.5 +1 CWE-669
Priority LOW 35
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03327 · Published 2021-02-02 · Partial fix · 19.03.15, 20.10.3 +1 CWE-400
Priority LOW 34
Docker Engine classifies a registry hostname as insecure using an any-match DNS check.
CVSS 4.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00087 · Published 2026-10-07 · Partial fix · 29.8.2, v2.0.0-beta.25 CWE-295
Priority LOW 34
A malicious image can advertise DiffIDs from another image while containing different layer contents.
CVSS 4.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.00167 · Published 2026-10-05 · Fixed in 0.33.1 CWE-354
Priority LOW 34
Moby is an open-source project created by Docker to enable software containerization.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0026 · Published 2024-02-01 · Partial fix · 25.0.2, 24.0.9 CWE-345
Priority LOW 34
HyperKit is a toolkit for embedding hypervisor capabilities in an application.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00317 · Published 2023-02-17 · No fix listed CWE-908
Priority LOW 34
HyperKit is a toolkit for embedding hypervisor capabilities in an application.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0025 · Published 2023-02-17 · No fix listed CWE-908
Priority LOW 33
Moby is an open source container framework.
CVSS 3.1HIGH 7.2· Local · Low privileges · User interaction · EPSS 0.00155 · Published 2026-06-05 · Partial fix · 2.0.0-beta.14, 29.5.1 CWE-427
Priority LOW 33
Moby) is an open source container framework developed by Docker Inc.
CVSS 3.1MEDIUM 6.8· Network · No auth · No interaction · EPSS 0.0144 · Published 2023-04-04 · Fixed in 20.10.24, 23.0.3 CWE-420
Priority LOW 33
Moby is an open-source project created by Docker to enable software containerization.
CVSS 3.1MEDIUM 6.3· Local · Low privileges · No interaction · EPSS 0.02848 · Published 2021-10-04 · Partial fix · 20.10.9 CWE-281
Priority LOW 32
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0114 · Published 2024-01-31 · Partial fix · 0.12.5 CWE-754
Priority LOW 32
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root.
CVSS 3.1MEDIUM 6.8· Adjacent network · Low privileges · No interaction · EPSS 0.01078 · Published 2021-02-02 · Partial fix · 19.03.15, 20.10.3 +1 CWE-22
Load more
THREATIST.IORead the docs