| CVE-2026-112917 |
Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
|
9.2
Critical
|
Nov 3, 2026 |
| CVE-2026-114409 |
Docker Desktop logs can expose stored third-party credentials
|
5.7
Medium
|
Oct 27, 2026 |
| CVE-2026-106581 |
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop…
|
8.2
High
|
Oct 9, 2026 |
| CVE-2026-17106 |
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer…
|
7.1
High
|
Aug 18, 2026 |
| CVE-2026-8936 |
Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested…
|
8.2
High
|
Jun 2, 2026 |
| CVE-2026-5843 |
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and…
|
8.8
High
|
May 22, 2026 |
| CVE-2026-5817 |
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when…
|
8.8
High
|
May 22, 2026 |
| CVE-2026-6406 |
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop
|
8.8
High
|
May 22, 2026 |
| CVE-2026-2664 |
An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows,…
|
6.8
Medium
|
Feb 24, 2026 |
| CVE-2025-13743 |
Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object…
|
2.4
Low
|
Dec 9, 2025 |
| CVE-2025-9164 |
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order
|
8.8
High
|
Oct 27, 2025 |
| CVE-2025-10657 |
In a hardened Docker environment, with Enhanced Container Isolation ( ECI…
|
8.7
High
|
Sep 26, 2025 |
| CVE-2025-9074 |
A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker…
|
9.3
Critical
|
Aug 20, 2025 |
| CVE-2025-6587 |
System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion
|
5.2
Medium
|
Jul 3, 2025 |
| CVE-2025-3911 |
Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead…
|
5.2
Medium
|
Apr 29, 2025 |
| CVE-2025-4095 |
Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers…
|
4.3
Medium
|
Apr 29, 2025 |
| CVE-2025-3224 |
A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local,…
|
7.3
High
|
Apr 28, 2025 |
| CVE-2025-1696 |
A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of…
|
5.2
Medium
|
Mar 6, 2025 |
| CVE-2024-9348 |
Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view
|
8.9
High
|
Oct 16, 2024 |
| CVE-2024-8696 |
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a…
|
8.9
High
|
Sep 12, 2024 |
| CVE-2024-8695 |
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious…
|
9.0
Critical
|
Sep 12, 2024 |
| CVE-2023-1802 |
In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the…
|
5.9
Medium
|
Apr 6, 2023 |