BU
Product
buildkit
20
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 1High 9Medium 9Low 1
Watch
Add buildkit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-93318 | 7.5 | Oct 5 | Cache poisoning via unvalidated image layer DiffIDs Affected: before 0.33.1 |
| CVE-2026-15793 | 7.5 | Jul 21 | Git source checkout from a bundle file could lead to command injection Affected: 0.30.0 through 0.31.1 |
| CVE-2026-15792 | 7.5 | Jul 21 | Possible panic when incorrect parameters sent from frontend Affected: before 0.31.2 |
| CVE-2026-15791 | 7.5 | Jul 21 | LLB file operation can be tricked to remove /tmp directory contents Affected: 0.10.0 before 0.31.2 |
| CVE-2026-15789 | 7.5 | Jul 21 | Malicious client can bypass destination directory validation on local sources upload Affected: before 0.31.2 |
| CVE-2026-15788 | 7.5 | Jul 20 | WCOW cache mount source selector resolves NTFS junctions outside of cache root Affected: before 0.31.2 |
| CVE-2026-33748 | 7.5 | Mar 27 | BuildKit Git URL subdir component can cause access to restricted files Affected: < 0.28.1 |
| CVE-2026-75593 | 7.2 | Aug 19 | BuildKit: Malicious client can bypass destination directory validation on local sources upload Affected: < 0.31.2 |
| CVE-2026-93316 | 7.1 | Oct 5 | Starting daemon with --cdi-disabled flag can lead to panic on specific builds Affected: before 0.33.1 |
Showing 9