ROOT-APP-GOBINARY-CVE-2026-42306 CVE-2026-42306 in github.com/docker/docker - Patched by Root

Root has patched CVE-2026-42306 in the github.com/docker/docker package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-41567 CVE-2026-41567 in github.com/docker/docker - Patched by Root

Root has patched CVE-2026-41567 in the github.com/docker/docker package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-34040 CVE-2026-34040 in github.com/docker/docker - Patched by Root

Root has patched CVE-2026-34040 in the github.com/docker/docker package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-41568 CVE-2026-41568 in github.com/docker/docker - Patched by Root

Root has patched CVE-2026-41568 in the github.com/docker/docker package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-33997 CVE-2026-33997 in github.com/docker/docker - Patched by Root

Root has patched CVE-2026-33997 in the github.com/docker/docker package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-YX87977 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default

Security vulnerability affects the flux-image-automation-controller package. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default...

PT-2026-108908

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer...

PT-2026-108925

Name of the Vulnerable Software and Affected Versions openPDC affected versions not specified Description The published Docker image contains a fixed administrative credential that does not require a change upon first use. An attacker with network access to the management interface can use this...

CVE-2026-106581: Improper Verification of Cryptographic Signature

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer...

CVE-2026-105278: Use of Hard-coded Credentials

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application...

AZL-107348 CVE-2026-97032 affecting package docker-compose 2.27.0-14

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107324 CVE-2026-97032 affecting package docker-cli 25.0.7-5

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107309 CVE-2026-97032 affecting package docker-buildx 0.14.0-17

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107321 CVE-2026-78669 affecting package docker-buildx 0.14.0-17

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107327 CVE-2026-78669 affecting package docker-cli 25.0.7-5

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107345 CVE-2026-78669 affecting package docker-compose 2.27.0-14

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107342 CVE-2026-78660 affecting package docker-cli 25.0.7-5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107354 CVE-2026-78659 affecting package docker-compose 2.27.0-14

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107306 CVE-2026-78659 affecting package docker-buildx 0.14.0-17

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107339 CVE-2026-78659 affecting package docker-cli 25.0.7-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...