13471 matches found
EUVD-2026-92818
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...
CVE-2026-103433 Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...
CVE-2026-103433
Docker Buildx Bake fails to request the required fs.read approval for specific filesystem inputs. This vulnerability allows an untrusted Bake definition to expose a readable file via a pathless secret (where the ID is interpreted as a client-side pathname) or to consume a local OCI image layout o...
CVE-2026-103433
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...
CVE-2026-103433 Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...
proof-of-exploit
Proof of Exploit Takes a public security advisory, reproduces...
AZL-106746 CVE-2026-93323 affecting package docker-buildx 0.14.0-17
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...
CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...
CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...
CVE-2026-93323
The Dockerfile frontend is vulnerable to a memory exhaustion attack because it loads Dockerfile and .dockerignore files into memory without a size limit. An attacker providing a build context with an oversized file can cause buildkitd to allocate proportional memory, potentially leading to a Deni...
CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...
SUSE CVE-2026-73802
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to...
Astra Linux – Vulnerability in docker.io-app
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is vulnerable to cache poisoning if the image is built FROM scratch. Additionally, changes to certain instructions—especially HEALTHCHECK and ONBUILD—do not trigger cache...
CVE-2026-103433: Missing Authorization
Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after...
PT-2026-106257
Name of the Vulnerable Software and Affected Versions Docker Buildx Bake affected versions not specified Description Docker Buildx Bake fails to request the required fs.read approval for specific filesystem inputs. This allows an untrusted Bake definition to expose a readable file by using a...
android-kernel-exploitation
Exploitazione del Kernel Android Obiettivo L'obiettivo di questo workshop è iniziare con l'analisi delle vulnerabilità del kernel e lo sfruttamento nella piattaforma Android. Utilizzo Clona il repository git clone https://github.com/cloudfuzz/android-kernel-exploitation /workshop URL delle Github...
supply-chain-security-toolkit
supply-chain-security-toolkit 공급망 보안Supply Chain Security 업...
ROOT-APP-GOBINARY-CVE-2025-15558 CVE-2025-15558 in github.com/docker/cli - Patched by Root
Root has patched CVE-2025-15558 in the github.com/docker/cli package for Root:Go. Multiple fixed versions available...
[SECURITY] Fedora 43 Update: docker-distribution-3.1.2-1.fc43
The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...
[SECURITY] Fedora 44 Update: docker-distribution-3.1.2-1.fc44
The toolkit to pack, ship, store, and deliver container content. This package provides Docker Registry - a service for storing and distributing OCI and Docker container images...