Vendor
Mobyproject
38 known vulnerabilities in products by Mobyproject, 0 of them actively exploited (CISA KEV).
Key figures
38
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-23653 | BuildKit interactive containers API does not validate entitlements check | 9.8 | |
| Critical | CVE-2024-23652 | BuildKit possible host system access from mount stub cleaner | 10.0 | |
| High | CVE-2023-28840 | moby/moby's dockerd daemon encrypted overlay network may be unauthenticated | 7.5 | |
| Medium | CVE-2021-41091 | Insufficiently restricted permissions on data directory in Docker Engine | 6.3 | |
| Medium | CVE-2023-28842 | moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated | 6.8 | |
| Medium | CVE-2017-16539 | Moby Project Moby: security vulnerability | 5.9 | |
| High | CVE-2024-23651 | BuildKit possible race condition with accessing subpaths from cache mounts | 8.7 | |
| Critical | CVE-2026-33747 | BuildKit vulnerable to malicious frontend causing file escape outside of storage root | 8.4 | |
| High | CVE-2026-33748 | BuildKit Git URL subdir component can cause access to restricted files | 7.5 | |
| High | CVE-2026-15788 | WCOW cache mount source selector resolves NTFS junctions outside of cache root | 7.5 | |
| High | CVE-2024-36623 | Moby Project Moby: Race Condition | 8.1 | |
| Medium | CVE-2023-26054 | Credentials inlined to Git URLs could end up in provenance attestation in BuildKit | 6.5 | |
| Medium | CVE-2018-10892 | Docker: Execution with Unnecessary Privileges | 6.3 | |
| High | CVE-2018-12608 | Moby Project Moby: security vulnerability | 7.5 | |
| Medium | CVE-2024-23650 | BuildKit possible panic when incorrect parameters sent from frontend | 5.3 | |
| Medium | CVE-2024-36620 | Moby Project Moby: NULL Pointer Dereference | 6.5 | |
| High | CVE-2026-15789 | Malicious client can bypass destination directory validation on local sources upload | 7.5 | |
| High | CVE-2026-15791 | LLB file operation can be tricked to remove /tmp directory contents | 7.5 | |
| Medium | CVE-2022-36109 | Moby vulnerability relating to supplementary group permissions | 5.3 | |
| High | CVE-2026-15792 | Possible panic when incorrect parameters sent from frontend | 7.5 | |
| Medium | CVE-2024-36621 | Moby Project Moby: Race Condition | 6.5 | |
| High | CVE-2026-15793 | Git source checkout from a bundle file could lead to command injection | 7.5 | |
| Medium | CVE-2023-28841 | moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted | 6.8 | |
| High | CVE-2024-29018 | External DNS requests from 'internal' networks could lead to data exfiltration | 5.9 | |
| High | CVE-2026-42306 | Moby: Race condition in docker cp allows bind mount redirection to host path | 7.2 |
Products
| Moby Project Moby | 21 | 0 |
| BuildKit | 12 | 0 |
| Hyperkit | 5 | 0 |