Mobyproject vulnerabilities

Products

• Moby 21
• Buildkit 12
• Hyperkit 5
• Moby\/v2 2

Newest

• moby buildkit Possible panic when incorrect parameters sent from frontend CVE-2026-15792 Fix available 6.3 MediumJuly 21, 2026
• moby buildkit LLB file operation can be tricked to remove /tmp directory contents CVE-2026-15791 3.3 LowJuly 21, 2026
• moby buildkit Malicious client can bypass destination directory validation on local sources upload CVE-2026-15789 Fix available 6.9 MediumJuly 21, 2026
• moby buildkit Git source checkout from a bundle file could lead to command injection CVE-2026-15793 6.5 MediumJuly 21, 2026
• moby buildkit WCOW cache mount source selector resolves NTFS junctions outside of cache root CVE-2026-15788 Fix available 5.6 MediumJuly 20, 2026
• docker engine, moby, mobyproject moby\/v2 +2 more Moby: Race condition in docker cp allows bind mount redirection to host path CVE-2026-42306 Fix available 7.2 HighMay 18, 2026
• docker engine, moby, mobyproject moby\/v2 +2 more Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap CVE-2026-41568 Fix available 6.1 MediumMay 18, 2026
• moby buildkit BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748 Fix available 8.2 HighMarch 26, 2026
• moby buildkit BuildKit vulnerable to malicious frontend causing file escape outside of storage root CVE-2026-33747 Fix available 8.4 HighMarch 26, 2026
• moby Moby's Firewalld reload removes bridge network isolation CVE-2025-54410 Fix available 3.3 LowJuly 29, 2025
• moby Moby's Firewalld reload makes published container ports accessible from remote hosts CVE-2025-54388 Fix available 5.1 MediumJuly 29, 2025
• mobyproject moby Moby Race Condition vulnerability CVE-2024-36623 Fix available 8.1 HighNovember 29, 2024
• mobyproject moby Moby Race Condition vulnerability CVE-2024-36621 Fix available 6.5 MediumNovember 29, 2024
• mobyproject moby NULL Pointer Dereference on moby image history CVE-2024-36620 Fix available 6.5 MediumNovember 29, 2024
• moby Moby IPv6 enabled on IPv4-only network interfaces CVE-2024-32473 Fix available 4.7 MediumApril 18, 2024
• moby External DNS requests from 'internal' networks could lead to data exfiltration CVE-2024-29018 Fix available 5.9 MediumMarch 20, 2024
• moby Moby classic builder cache poisoning CVE-2024-24557 Fix available 6.9 MediumFebruary 1, 2024
• moby buildkit BuildKit interactive containers API does not validate entitlements check CVE-2024-23653 Public exploitFix available 9.8 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible host system access from mount stub cleaner CVE-2024-23652 Public exploitFix available 10.0 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible race condition with accessing subpaths from cache mounts CVE-2024-23651 Fix available 8.7 HighJanuary 31, 2024
• moby buildkit BuildKit possible panic when incorrect parameters sent from frontend CVE-2024-23650 Fix available 5.3 MediumJanuary 31, 2024
• moby moby/moby's dockerd daemon encrypted overlay network may be unauthenticated CVE-2023-28840 Fix available 7.5 HighApril 4, 2023
• moby moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted CVE-2023-28841 Fix available 6.8 MediumApril 4, 2023
• moby moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated CVE-2023-28842 Fix available 6.8 MediumApril 4, 2023
• moby buildkit Credentials inlined to Git URLs could end up in provenance attestation in BuildKit CVE-2023-26054 Fix available 6.5 MediumMarch 6, 2023
• moby hyperkit Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVE-2021-32847 7.1 HighFebruary 20, 2023
• moby hyperkit Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVE-2021-32846 7.7 HighFebruary 17, 2023
• moby hyperkit Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notify CVE-2021-32845 7.7 HighFebruary 17, 2023
• moby hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0... CVE-2021-32844 6.2 MediumFebruary 17, 2023
• moby hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0... CVE-2021-32843 6.2 MediumFebruary 17, 2023
• moby, fedoraproject fedora +1 more Moby vulnerability relating to supplementary group permissions CVE-2022-36109 Fix available 5.3 MediumSeptember 9, 2022
• kubernetes cri-o, mobyproject moby, fedoraproject fedora +1 more +3 more Incorrect Default Permissions in CRI-O CVE-2022-27652 Fix available 5.3 MediumApril 18, 2022
• debian linux, moby, fedoraproject fedora +1 more +3 more Default inheritable capabilities for linux container should be empty CVE-2022-24769 Fix available 5.9 MediumMarch 24, 2022
• moby, fedoraproject fedora +1 more Insufficiently restricted permissions on data directory in Docker Engine CVE-2021-41091 Public exploitFix available 6.3 MediumOctober 4, 2021
• moby, fedoraproject fedora +1 more `docker cp` allows unexpected chmod of host files CVE-2021-41089 Fix available 2.8 LowOctober 4, 2021
• mobyproject moby Docker Authentication Bypass CVE-2018-12608 Fix available 7.5 HighSeptember 10, 2018
• [unknown] docker, mobyproject moby, opensuse leap +3 more +5 more The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does... CVE-2018-10892 Fix available 6.3 MediumJuly 6, 2018
• mobyproject moby Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP) CVE-2017-16539 Fix available 5.9 MediumNovember 4, 2017