MO
Vendor
moby
32
CVEs
0
On KEV
13
New 30D
Products
BU9.8
buildkit
moby
20 CVEs0 on KEV10 new
MO8.1
moby
moby
5 CVEs0 on KEV1 new
MO6.9
Moby overlay network driver
Moby
1 CVEs0 on KEV1 new
SY5.5
sys
moby
1 CVEs0 on KEV1 new
DE7.2
Docker Engine
moby
1 CVEs0 on KEV0 new
GO7.1
go-archive
moby
1 CVEs0 on KEV0 new
MO7.2
moby/v2/daemon
moby
1 CVEs0 on KEV0 new
NW–
Netsuite Web Server
Moby
1 CVEs0 on KEV0 new
SP6.5
spdystream
moby
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-61801 | SY sys moby | 5.5 | Oct 8 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files |
| CVE-2026-92543 | MO Moby Moby | 7.6 | Oct 7 | Docker Engine insecure-registry fallback via malicious DNS responses |
| CVE-2026-92542 | MO Moby overlay network driver Moby | 6.9 | Oct 7 | Blind VXLAN injection into encrypted overlay networks from cluster peer |
| CVE-2026-93321 | BU BuildKit moby | 6.9 | Oct 5 | Malformed LLB file operation can crash buildkitd |
| CVE-2026-93315 | BU BuildKit moby | 5.8 | Oct 5 | BuildKit proxy CA cleanup can be disrupted by build steps |
| CVE-2026-93326 | BU BuildKit moby | 6.0 | Oct 5 | Crafted Git build source can bypass certain policy validation |
| CVE-2026-93323 | BU BuildKit moby | 6.8 | Oct 5 | Oversized Dockerfile or .dockerignore can exhaust buildkitd memory |
| CVE-2026-93322 | BU BuildKit moby | 6.9 | Oct 5 | Malformed MergeOp can crash the BuildKit daemon |
| CVE-2026-93320 | BU BuildKit moby | 6.0 | Oct 5 | BuildKit improperly handles special files in build snapshots |
| CVE-2026-93319 | BU BuildKit moby | 5.7 | Oct 5 | A malicious frontend can cause a daemon panic |
| CVE-2026-93318 | BU BuildKit moby | 7.5 | Oct 5 | Cache poisoning via unvalidated image layer DiffIDs |
| CVE-2026-93317 | BU BuildKit moby | 5.9 | Oct 5 | Container blob cache can accept unverified content |
| CVE-2026-93316 | BU BuildKit moby | 7.1 | Oct 5 | Starting daemon with --cdi-disabled flag can lead to panic on specific builds |
| CVE-2026-75593 | BU buildkit moby | 7.2 | Aug 19 | BuildKit: Malicious client can bypass destination directory validation on local sources upload |
| CVE-2026-61711 | BU buildkit moby | 5.3 | Aug 19 | BuildKit: Custom frontend could bypass Seccomp/AppArmor |
| CVE-2026-61712 | BU buildkit moby | 2.3 | Aug 19 | BuildKit: Possible runtime DoS via unbounded group parsing |
| CVE-2026-17106 | GO go-archive moby | 7.1 | Aug 18 | Tar extraction in moby/go-archive can write outside the destination directory via link following |
| CVE-2026-15793 | BU BuildKit moby | 7.5 | Jul 21 | Git source checkout from a bundle file could lead to command injection |
| CVE-2026-15792 | BU BuildKit moby | 7.5 | Jul 21 | Possible panic when incorrect parameters sent from frontend |
| CVE-2026-15791 | BU BuildKit moby | 7.5 | Jul 21 | LLB file operation can be tricked to remove /tmp directory contents |
| CVE-2026-15789 | BU BuildKit moby | 7.5 | Jul 21 | Malicious client can bypass destination directory validation on local sources upload |
| CVE-2026-15788 | BU BuildKit moby | 7.5 | Jul 20 | WCOW cache mount source selector resolves NTFS junctions outside of cache root |
| CVE-2026-42306 | MO moby moby | 7.2 | Jun 12 | Moby: Race condition in docker cp allows bind mount redirection to host path |
| CVE-2026-41568 | MO moby moby | 6.1 | Jun 12 | Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap |
| CVE-2026-41567 | DE Docker Engine moby | 7.2 | Jun 5 | Docker: `PUT /containers/{id}/archive` executes container binary on the host |
| CVE-2026-35469 | SP spdystream moby | 6.5 | Apr 16 | SpdyStream: DOS on CRI |
| CVE-2026-33997 | MO moby moby | 8.1 | Mar 31 | Moby: Off-by-one error in plugin privilege validation |
| CVE-2026-34040 | MO moby moby | 7.8 | Mar 31 | Moby: AuthZ plugin bypass with oversized request body |
| CVE-2026-33748 | BU buildkit moby | 7.5 | Mar 27 | BuildKit Git URL subdir component can cause access to restricted files |
| CVE-2026-33747 | BU buildkit moby | 9.8 | Mar 27 | BuildKit vulnerable to malicious frontend causing file escape outside of storage root |
| CVE-2001-0275 | NW Netsuite Web Server Moby | – | May 3 | Moby Netsuite Web Server 1.02 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long HTTP request |