DD
Product
Docker Desktop
17
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 2High 11Medium 4Low 0
Watch
Add Docker Desktop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-8696 | 9.8 | Sep 12 | A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2. Affected: before 4.34.2 |
| CVE-2024-8695 | 9.8 | Sep 12 | A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2. Affected: before 4.34.2 |
| CVE-2024-9348 | 8.9 | Oct 16 | Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view Affected: before 4.34.3 |
| CVE-2026-2664 | 7.8 | Feb 24 | Out of bounds read vulnerability in grpcfuse kernel module Affected: before 4.62.0; before 4.62.0; before 4.62.0 |
| CVE-2025-3224 | 7.8 | Apr 28 | Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion Affected: before 4.41.0 |
| CVE-2022-37326 | 7.8 | Apr 27 | Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field… Affected: before 4.6.0 |
| CVE-2021-37841 | 7.8 | Aug 12 | Docker Desktop before 3.6.0 suffers from incorrect access control Affected: before 3.6.0 |
| CVE-2023-1802 | 7.5 | Apr 6 | In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing… Affected: 4.17.0; 4.17.1 |
| CVE-2026-106581 | 7.3 | Oct 9 | Docker Desktop for Windows installer failed to verify external packages Affected: before 4.92.0 |
| CVE-2026-17106 | 7.1 | Aug 18 | Tar extraction in moby/go-archive can write outside the destination directory via link following Affected: before 4.86.0 |
| CVE-2022-34292 | 7.1 | Apr 27 | Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder… Affected: before 4.6.0 |
| CVE-2022-31647 | 7.1 | Apr 27 | Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different… Affected: before 4.6.0 |
| CVE-2024-6222 | 7.0 | Jul 9 | In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages Affected: before 4.29.0 |
| CVE-2020-10665 | 6.7 | Mar 18 | Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary… Affected: before 2.1.0.9; before 2.2.0.4; before 2.2.2.0 |
| CVE-2022-38730 | 6.3 | Apr 27 | Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the… Affected: before 4.6.0 |
| CVE-2026-114409 New | 5.7 | Oct 27 | Docker Desktop logs can expose stored third-party credentials Affected: 4.39.0 before 4.97.0 |
| CVE-2024-5652 | 5.5 | Jul 9 | In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode Affected: before 4.31.0 |
Showing 17