Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,985All CVEsplus 19,118 rejected
- 417Last 24 hours2,843 in the last 7 days
- 16,805Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 11 | 19 | 2 | 0 | 32 | 57 |
| 2025 | 0 | 0 | 1 | 1 | 0 | 2 | 25 |
| 2024 | 3 | 1 | 4 | 0 | 0 | 8 | 23 |
| 2023 | 0 | 4 | 5 | 0 | 0 | 9 | 15 |
| 2022 | 0 | 0 | 2 | 0 | 0 | 2 | 6 |
| 2021 | 0 | 0 | 3 | 1 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-121520 | Malicious client could set xattr value outside of BuildKit state directoryMoby · BuildKit | Medium4.5 |
| CVE-2026-121522 | Possible panic from Git source resolvermoby · BuildKit | Medium6.7 |
| CVE-2026-61801 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesmoby · sys | Medium5.5 |
| CVE-2026-92543 | Docker Engine insecure-registry fallback via malicious DNS responsesDocker · Docker Engine | High7.6 |
| CVE-2026-92542 | Blind VXLAN injection into encrypted overlay networks from cluster peerDocker · Docker Engine | Medium6.9 |
| CVE-2026-93321 | Malformed LLB file operation can crash buildkitdmoby · BuildKit | Medium6.9 |
| CVE-2026-93315 | BuildKit proxy CA cleanup can be disrupted by build stepsmoby · BuildKit | Medium5.8 |
| CVE-2026-93326 | Crafted Git build source can bypass certain policy validationmoby · BuildKit | Medium6.0 |
| CVE-2026-93323 | Oversized Dockerfile or .dockerignore can exhaust buildkitd memorymoby · BuildKit | Medium6.8 |
| CVE-2026-93322 | Malformed MergeOp can crash the BuildKit daemonmoby · BuildKit | Medium6.9 |
| CVE-2026-93320 | BuildKit improperly handles special files in build snapshotsmoby · BuildKit | Medium6.0 |
| CVE-2026-93319 | A malicious frontend can cause a daemon panicmoby · BuildKit | Medium5.7 |
| CVE-2026-93318 | Cache poisoning via unvalidated image layer DiffIDsmoby · BuildKit | High7.5 |
| CVE-2026-93317 | Container blob cache can accept unverified contentmoby · BuildKit | Medium5.9 |
| CVE-2026-93316 | Starting daemon with --cdi-disabled flag can lead to panic on specific buildsmoby · BuildKit | High7.1 |
| CVE-2026-75593 | BuildKit: Malicious client can bypass destination directory validation on local sources uploadmoby · buildkit | High7.2 |
| CVE-2026-61711 | BuildKit: Custom frontend could bypass Seccomp/AppArmormoby · buildkit | Medium5.3 |
| CVE-2026-61712 | BuildKit: Possible runtime DoS via unbounded group parsingmoby · buildkit | Low2.3 |
| CVE-2026-17106 | Tar extraction in moby/go-archive can write outside the destination directory via link followingmoby · go-archive | High7.1 |
| CVE-2026-15793 | Git source checkout from a bundle file could lead to command injectionmoby · BuildKit | Medium6.5 |
| CVE-2026-15792 | Possible panic when incorrect parameters sent from frontendmoby · BuildKit | Medium6.3 |
| CVE-2026-15791 | LLB file operation can be tricked to remove /tmp directory contentsmoby · BuildKit | Low3.3 |
| CVE-2026-15789 | Malicious client can bypass destination directory validation on local sources uploadmoby · BuildKit | Medium6.9 |
| CVE-2026-15788 | WCOW cache mount source selector resolves NTFS junctions outside of cache rootmoby · BuildKit | Medium5.6 |
| CVE-2026-42306 | Moby: Race condition in docker cp allows bind mount redirection to host pathmoby · moby | High7.2 |
| CVE-2026-41568 | Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapmoby · moby | Medium6.1 |
| CVE-2026-41567 | Docker: `PUT /containers/{id}/archive` executes container binary on the hostmoby · moby/v2/daemon | High7.2 |
| CVE-2026-35469 | SpdyStream: DOS on CRImoby · spdystream | High8.7 |
| CVE-2026-33997 | Moby: Off-by-one error in plugin privilege validationmoby · moby | Medium6.8 |
| CVE-2026-34040 | Moby: AuthZ plugin bypass with oversized request bodymoby · moby | High8.8 |
| CVE-2026-33748 | BuildKit Git URL subdir component can cause access to restricted filesmoby · buildkit | High8.2 |
| CVE-2026-33747 | BuildKit vulnerable to malicious frontend causing file escape outside of storage rootmoby · buildkit | High8.4 |
| CVE-2025-54410 | Moby's Firewalld reload removes bridge network isolationmoby · moby | Low3.3 |
| CVE-2025-54388 | Moby's Firewalld reload makes published container ports accessible from remote hostsmoby · moby | Medium5.1 |
| CVE-2024-41110 | Moby authz zero length regressionmoby · moby | Critical10.0 |
| CVE-2024-32473 | Moby IPv6 enabled on IPv4-only network interfacesmoby · moby | Medium4.7 |
| CVE-2024-29018 | External DNS requests from 'internal' networks could lead to data exfiltrationmoby · moby | Medium5.9 |
| CVE-2024-24557 | Moby classic builder cache poisoningmoby · moby | Medium6.9 |
| CVE-2024-23653 | BuildKit interactive containers API does not validate entitlements checkmoby · buildkit | Critical9.8 |
| CVE-2024-23652 | BuildKit possible host system access from mount stub cleanermoby · buildkit | Critical10.0 |
| CVE-2024-23651 | BuildKit possible race condition with accessing subpaths from cache mountsmoby · buildkit | High8.7 |
| CVE-2024-23650 | BuildKit possible panic when incorrect parameters sent from frontendmoby · buildkit | Medium5.3 |
| CVE-2023-28840 | moby/moby's dockerd daemon encrypted overlay network may be unauthenticatedmoby · moby | High7.5 |
| CVE-2023-28841 | moby/moby's dockerd daemon encrypted overlay network traffic may be unencryptedmoby · moby | Medium6.8 |
| CVE-2023-28842 | moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticatedmoby · moby | Medium6.8 |
| CVE-2023-26054 | Credentials inlined to Git URLs could end up in provenance attestation in BuildKitmoby · buildkit | Medium6.5 |
| CVE-2021-32847 | Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txmoby · hyperkit | High7.1 |
| CVE-2021-32846 | Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txmoby · hyperkit | High7.7 |
| CVE-2021-32845 | Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notifymoby · hyperkit | High7.7 |
| CVE-2021-32844 | HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to…moby · hyperkit | Medium6.2 |