| CVE-2026-121614 |
Docker Sandboxes host Git executes repository-controlled programs
|
7.1
High
|
Nov 3, 2026 |
| CVE-2026-103916 |
Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace
|
8.4
High
|
Nov 3, 2026 |
| CVE-2026-105452 |
Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy
|
5.9
Medium
|
Oct 8, 2026 |
| CVE-2026-101998 |
Docker Sandboxes could fail open while masking credentials in protected proxy responses
|
5.9
Medium
|
Oct 8, 2026 |
| CVE-2026-105570 |
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed…
|
6.7
Medium
|
Oct 8, 2026 |
| CVE-2026-79994 |
The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized…
|
8.7
High
|
Sep 15, 2026 |
| CVE-2026-77179 |
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file…
|
9.4
Critical
|
Sep 15, 2026 |
| CVE-2026-17106 |
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer…
|
7.1
High
|
Aug 18, 2026 |
| CVE-2026-18171 |
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the…
|
5.7
Medium
|
Aug 12, 2026 |
| CVE-2026-12539 |
Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not…
|
5.1
Medium
|
Jun 18, 2026 |
| CVE-2026-12039 |
Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network…
|
5.7
Medium
|
Jun 18, 2026 |