Vulnerabilities

TI-2026-30614 CVE-2026-42306 · GHSA-rg2x-37c3-w2rh

Moby: Race condition in docker cp allows bind mount redirection to host path

LOW 30

Moby is an open source container framework.

CVSS 3.1HIGH 7.2 Local Low privileges User interaction EPSS 0.00104 Published 2026-06-12 Partial fix · 2.0.0-beta.14 CWE-367

TI-2026-30123 CVE-2026-41568 · GHSA-vp62-88p7-qqf5

Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

LOW 26

Moby is an open source container framework.

CVSS 3.1MEDIUM 6.1 Local Low privileges User interaction EPSS 0.00108 Published 2026-06-12 Partial fix · 2.0.0-beta.14 CWE-367

TI-2025-34216 CVE-2025-54410 · GHSA-4vq8-7jfc-9cvp

Moby's Firewalld reload removes bridge network isolation

LOW 23

Moby is an open source container framework developed by Docker Inc.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00177 Published 2025-07-30 Partial fix · 25.0.13, 28.0.0 CWE-909

TI-2025-34196 CVE-2025-54388 · GHSA-x4rx-4gw3-53p4

Moby's Firewalld reload makes published container ports accessible from remote hosts

LOW 29

Moby is an open source container framework developed by Docker Inc.

CVSS 4.0MEDIUM 5.1 Adjacent network No auth User interaction EPSS 0.00265 Published 2025-07-30 Partial fix · 28.3.3 CWE-909

TI-2024-24355 CVE-2024-36623 · GHSA-gh5c-3h97-2f3q

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package…

LOW 36

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00642 Published 2024-11-29 Fixed in 25.0.4 CWE-362

TI-2024-24353 CVE-2024-36621 · GHSA-2mj3-vfvx-fc43

moby v25.0.5 is affected by a Race Condition in…

LOW 30

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00626 Published 2024-11-29 Fixed in 26.0.0 CWE-362

TI-2024-24352 CVE-2024-36620 · GHSA-q59j-vv4j-v33c

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

LOW 30

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00819 Published 2024-11-29 Partial fix · 26.1.0 CWE-476

TI-2024-21367 CVE-2024-32473 · GHSA-x84c-p2g9-rqv9

Moby IPv6 enabled on IPv4-only network interfaces

LOW 29

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.0035 Published 2024-04-18 Fixed in 26.0.2 CWE-668

TI-2024-19200 CVE-2024-29018 · GHSA-mq39-4gv4-mvpx

External DNS requests from 'internal' networks could lead to data exfiltration

LOW 36

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00744 Published 2024-03-20 Fixed in 26.0.0-rc3, 25.0.5 +1 CWE-669

TI-2024-16178 CVE-2024-24557 · GHSA-xw73-rw38-6vjc

Moby classic builder cache poisoning

LOW 34

Moby is an open-source project created by Docker to enable software containerization.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0026 Published 2024-02-01 Partial fix · 25.0.2, 24.0.9 CWE-345

TI-2023-13346 CVE-2023-28840 · GHSA-232p-vwff-86mp

moby/moby's dockerd daemon encrypted overlay network may be unauthenticated

MEDIUM 42

Moby is an open source container framework developed by Docker Inc.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.02559 Published 2023-04-04 Fixed in 20.10.24, 23.0.3 CWE-420

TI-2023-13347 CVE-2023-28841 · GHSA-33pg-m6jh-5237

moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted

LOW 31

Moby is an open source container framework developed by Docker Inc.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00691 Published 2023-04-04 Fixed in 20.10.24, 23.0.3 CWE-311

TI-2023-13348 CVE-2023-28842 · GHSA-6wrf-mxfj-pf5p

moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated

LOW 33

Moby) is an open source container framework developed by Docker Inc.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.0144 Published 2023-04-04 Fixed in 20.10.24, 23.0.3 CWE-420

TI-2022-16532 CVE-2022-36109 · GHSA-rc4r-wh2q-q6c4

Moby vulnerability relating to supplementary group permissions

LOW 30

Moby is an open-source project created by Docker to enable software containerization.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.01054 Published 2022-09-09 Partial fix · 20.10.18 CWE-863

TI-2022-10633 CVE-2022-27652 · GHSA-4hj2-r2pm-3hc6

Incorrect default permissions in cri-o

LOW 24

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00245 Published 2022-04-18 Partial fix · 1.24.0 CWE-276

TI-2022-08583 CVE-2022-24769 · GHSA-2mm7-x5h6-5pvq

Default inheritable capabilities for linux container should be empty

LOW 27

Moby is an open-source project created by Docker to enable and accelerate software containerization.

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00492 Published 2022-03-24 Partial fix · 20.10.14 CWE-732

TI-2021-17931 CVE-2021-41089 · GHSA-v994-f8vw-g7j4

`docker cp` allows unexpected chmod of host files

LOW 28

Moby is an open-source project created by Docker to enable software containerization.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.0029 Published 2021-10-04 Partial fix · 20.10.9 CWE-281

TI-2021-17933 CVE-2021-41091 · GHSA-3fwx-pjgw-3558

Insufficiently restricted permissions on data directory in Docker Engine

LOW 33

Moby is an open-source project created by Docker to enable software containerization.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.02848 Published 2021-10-04 Partial fix · 20.10.9 CWE-281

TI-2018-09052 CVE-2018-12608 · GHSA-qrqr-3x5j-2xw9

An issue was discovered in Docker Moby before 17.06.0.

LOW 35

An issue was discovered in Docker Moby before 17.06.0.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0092 Published 2018-09-10 Partial fix · 17.06.0-ce CWE-295

TI-2018-07705 CVE-2018-10892 · GHSA-hg92-xfw5-qgvm

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current…

LOW 26

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01126 Published 2018-07-06 Fixed CWE-250

TI-2017-12151 CVE-2017-16539 · GHSA-vfjc-2qcw-j95j

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does…

LOW 30

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveragin…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01829 Published 2017-11-04 Fixed in 17.12.0-ce CWE-200

Vulnerabilities

Filters