Vendor
Moby
56 known vulnerabilities in products by Moby, 0 of them actively exploited (CISA KEV).
Key figures
56
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-34040 | Moby: AuthZ plugin bypass with oversized request body | 8.8 | |
| Critical | CVE-2024-41110 | Moby authz zero length regression | 10.0 | |
| Critical | CVE-2024-23653 | BuildKit interactive containers API does not validate entitlements check | 9.8 | |
| Critical | CVE-2024-23652 | BuildKit possible host system access from mount stub cleaner | 10.0 | |
| High | CVE-2023-28840 | moby/moby's dockerd daemon encrypted overlay network may be unauthenticated | 7.5 | |
| Medium | CVE-2021-21285 | Docker daemon crash during image pull of malicious image | 6.5 | |
| High | CVE-2026-35469 | SpdyStream: DOS on CRI | 6.5 | |
| Medium | CVE-2021-41091 | Insufficiently restricted permissions on data directory in Docker Engine | 6.3 | |
| Medium | CVE-2023-28842 | moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated | 6.8 | |
| High | CVE-2026-17106 | Tar extraction in moby/go-archive can write outside the destination directory via link following | — | |
| High | CVE-2024-23651 | BuildKit possible race condition with accessing subpaths from cache mounts | 8.7 | |
| High | CVE-2026-75593 | BuildKit: Malicious client can bypass destination directory validation on local sources upload | — | |
| Critical | CVE-2026-33747 | BuildKit vulnerable to malicious frontend causing file escape outside of storage root | 8.4 | |
| High | CVE-2026-33748 | BuildKit Git URL subdir component can cause access to restricted files | 7.5 | |
| High | CVE-2026-15788 | WCOW cache mount source selector resolves NTFS junctions outside of cache root | 7.5 | |
| High | CVE-2026-92543 | Docker Engine insecure-registry fallback via malicious DNS responses | — | |
| High | CVE-2026-93318 | Cache poisoning via unvalidated image layer DiffIDs | — | |
| Medium | CVE-2021-21284 | privilege escalation in Moby | 6.8 | |
| High | CVE-2026-93316 | Starting daemon with --cdi-disabled flag can lead to panic on specific builds | — | |
| Medium | CVE-2023-26054 | Credentials inlined to Git URLs could end up in provenance attestation in BuildKit | 6.5 | |
| Medium | CVE-2024-23650 | BuildKit possible panic when incorrect parameters sent from frontend | 5.3 | |
| Medium | CVE-2026-93321 | Malformed LLB file operation can crash buildkitd | — | |
| Medium | CVE-2026-93322 | Malformed MergeOp can crash the BuildKit daemon | — | |
| Medium | CVE-2026-92542 | Blind VXLAN injection into encrypted overlay networks from cluster peer | — | |
| Medium | CVE-2026-93323 | Oversized Dockerfile or .dockerignore can exhaust buildkitd memory | — |