MO
Product
moby
11
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 1High 6Medium 4Low 0
Watch
Add moby to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-41110 | 9.9 | Jul 24 | Moby authz zero length regression Affected: >= 19.03.0, <= 19.03.15; >= 20.0.0, <= 20.10.27; >= 23.0.0, <= 23.0.14; >= 24.0.0, <= 24.0.9; >= 25.0.0, <= 25.0.5; >= 26.0.0, <= 26.0.2; +3 more |
| CVE-2026-33997 | 8.1 | Mar 31 | Moby: Off-by-one error in plugin privilege validation Affected: < 29.3.1 |
| CVE-2026-34040 | 7.8 | Mar 31 | Moby: AuthZ plugin bypass with oversized request body Affected: < 29.3.1 |
| CVE-2024-24557 | 7.8 | Feb 1 | Moby classic builder cache poisoning Affected: >= 25.0.0, < 25.0.2; < 24.0.9 |
| CVE-2026-92543 | 7.6 | Oct 7 | Docker Engine insecure-registry fallback via malicious DNS responses Affected: before v2.0.0-beta.25 |
| CVE-2024-29018 | 7.5 | Mar 20 | External DNS requests from 'internal' networks could lead to data exfiltration Affected: >= 26.0.0-rc1, < 26.0.0-rc3; >= 25.0.0, < 25.0.5; < 23.0.11 |
| CVE-2026-42306 | 7.2 | Jun 12 | Moby: Race condition in docker cp allows bind mount redirection to host path Affected: github.com/docker/docker/daemon <= 28.5.2; Docker Engine < 29.5.1; github.com/moby/moby/v2/daemon < 2.0.0-beta.14 |
| CVE-2024-32473 | 6.5 | Apr 18 | Moby IPv6 enabled on IPv4-only network interfaces Affected: >= 26.0.0, < 26.0.2 |
| CVE-2026-41568 | 6.1 | Jun 12 | Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap Affected: github.com/docker/docker/daemon <= 28.5.2; Docker Engine < 29.5.1; github.com/moby/moby/v2/daemon < 2.0.0-beta.14 |
| CVE-2025-54410 | 5.2 | Jul 30 | Moby's Firewalld reload removes bridge network isolation Affected: <= 25.0.12 |
| CVE-2025-54388 | 4.6 | Jul 30 | Moby's Firewalld reload makes published container ports accessible from remote hosts Affected: >= 28.2.0, < 28.3.3 |
Showing 11