43 entries matching docker — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-105769 | kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-co | CRITICAL | 9.3 | — | NVD | 2026-11-02 |
| CVE-2026-120460 | Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to ma | HIGH | 8.7 | — | NVD | 2026-11-02 |
| CVE-2026-120306 | Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on t | CRITICAL | 9.9 | 30%ile | NVD | 2026-11-01 |
| CVE-2026-120203 | ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users | HIGH | 8.7 | 29%ile | NVD | 2026-10-31 |
| CVE-2026-63377 | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-30 |
| CVE-2026-62331 | praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Contro | HIGH | 8.2 | 56%ile | NVD | 2026-10-30 |
| CVE-2026-119119 | Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails | HIGH | 8.7 | 30%ile | NVD | 2026-10-29 |
| CVE-2026-119120 | Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bod | HIGH | 7.7 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-118763 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/regis | HIGH | 7.4 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-119122 | Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API cl | MEDIUM | 6.9 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-119121 | Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows auth | MEDIUM | 5.3 | 21%ile | NVD | 2026-10-29 |
| CVE-2026-63190 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f | CRITICAL | 9.4 | 46%ile | NVD | 2026-10-28 |
| CVE-2026-59177 | ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Ass | HIGH | 8.8 | 67%ile | NVD | 2026-10-28 |
| CVE-2026-59179 | OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated | HIGH | 8.3 | 33%ile | NVD | 2026-10-28 |
| CVE-2026-115885 | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output | MEDIUM | 5.4 | 1%ile | GitHub | 2026-10-28 |
| CVE-2026-103288 | Ghost: Authorization Bypass in Comment Like Feature | MEDIUM | 6.5 | 10%ile | GitHub | 2026-10-27 |
| CVE-2026-114409 | Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local appl | MEDIUM | 5.7 | 1%ile | NVD | 2026-10-27 |
| CVE-2026-116679 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deploy | MEDIUM | 5.4 | 24%ile | NVD | 2026-10-27 |
| CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | HIGH | 7.5 | 50%ile | Microsoft | 2026-10-13 |
| CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | HIGH | 7.5 | 42%ile | Microsoft | 2026-10-13 |
| CVE-2026-61801 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files | MEDIUM | 5.5 | 2%ile | Microsoft | 2026-10-13 |
| CVE-2026-92543 | Docker Engine insecure-registry fallback via malicious DNS responses | UNKNOWN | — | 0%ile | Microsoft | 2026-10-13 |
| CVE-2026-93323 | Oversized Dockerfile or .dockerignore can exhaust buildkitd memory | UNKNOWN | — | 1%ile | Microsoft | 2026-10-13 |
| CVE-2026-56855 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh | HIGH | 7.5 | 43%ile | Microsoft | 2026-09-08 |
| CVE-2026-78662 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh | HIGH | 7.5 | 37%ile | Microsoft | 2026-09-08 |
| CVE-2026-84304 | gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation | HIGH | 7.5 | 49%ile | Microsoft | 2026-09-08 |
| CVE-2026-81870 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | UNKNOWN | — | 18%ile | Microsoft | 2026-09-08 |
| CVE-2026-37236 | grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override hea | MEDIUM | 5.3 | 38%ile | Microsoft | 2026-08-11 |
| CVE-2026-17106 | Tar extraction in moby/go-archive can write outside the destination directory via link following | UNKNOWN | — | 38%ile | Microsoft | 2026-08-11 |
| CVE-2026-61711 | BuildKit: Custom frontend could bypass Seccomp/AppArmor | UNKNOWN | — | 29%ile | Microsoft | 2026-08-11 |
| CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | CRITICAL | 10.0 | 46%ile | Microsoft | 2026-05-12 |
| CVE-2026-39830 | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh | CRITICAL | 9.1 | 52%ile | Microsoft | 2026-05-12 |
| CVE-2026-39832 | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent | CRITICAL | 9.1 | 52%ile | Microsoft | 2026-05-12 |
| CVE-2026-39833 | Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent | CRITICAL | 9.1 | 41%ile | Microsoft | 2026-05-12 |
| CVE-2026-39834 | Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh | CRITICAL | 9.1 | 49%ile | Microsoft | 2026-05-12 |
| CVE-2026-39829 | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh | HIGH | 7.5 | 40%ile | Microsoft | 2026-05-12 |
| CVE-2026-46597 | Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh | HIGH | 7.5 | 41%ile | Microsoft | 2026-05-12 |
| CVE-2026-39827 | Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh | MEDIUM | 6.5 | 20%ile | Microsoft | 2026-05-12 |
| CVE-2026-39828 | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh | MEDIUM | 6.3 | 31%ile | Microsoft | 2026-05-12 |
| CVE-2026-39835 | Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh | MEDIUM | 5.3 | 43%ile | Microsoft | 2026-05-12 |
| CVE-2026-46598 | Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent | MEDIUM | 5.3 | 36%ile | Microsoft | 2026-05-12 |
| CVE-2025-47913 | Potential denial of service in golang.org/x/crypto/ssh/agent | HIGH | 7.5 | 52%ile | Microsoft | 2025-11-11 |
| CVE-2025-22872 | Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net | MEDIUM | 6.5 | 46%ile | Microsoft | 2025-04-08 |