DD
Product
Docker Desktop
17
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 2High 11Medium 4Low 0
Watch
Add Docker Desktop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-9348 | 8.9 | Oct 16 | Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view Affected: before 4.34.3 |
| CVE-2026-2664 | 7.8 | Feb 24 | Out of bounds read vulnerability in grpcfuse kernel module Affected: before 4.62.0; before 4.62.0; before 4.62.0 |
| CVE-2025-3224 | 7.8 | Apr 28 | Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion Affected: before 4.41.0 |
| CVE-2022-37326 | 7.8 | Apr 27 | Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field… Affected: before 4.6.0 |
| CVE-2021-37841 | 7.8 | Aug 12 | Docker Desktop before 3.6.0 suffers from incorrect access control Affected: before 3.6.0 |
| CVE-2023-1802 | 7.5 | Apr 6 | In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing… Affected: 4.17.0; 4.17.1 |
| CVE-2026-106581 | 7.3 | Oct 9 | Docker Desktop for Windows installer failed to verify external packages Affected: before 4.92.0 |
| CVE-2026-17106 | 7.1 | Aug 18 | Tar extraction in moby/go-archive can write outside the destination directory via link following Affected: before 4.86.0 |
| CVE-2022-34292 | 7.1 | Apr 27 | Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder… Affected: before 4.6.0 |
| CVE-2022-31647 | 7.1 | Apr 27 | Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different… Affected: before 4.6.0 |
| CVE-2024-6222 | 7.0 | Jul 9 | In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages Affected: before 4.29.0 |
Showing 11