BIT-DOCKER-CLI-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries docker-compose.exe, docker-buildx.exe, etc. that are executed when a...

CVE-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries docker-compose.exe, docker-buildx.exe, etc. that are executed when a...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element in the legacy system-wide cli-plugin path. An attacker can gain elevated privileges by placing a crafted binary in C:\ProgramData\Docker\cli-plugins directory that is searched by the application when...

Docker CLI 安全漏洞

Docker CLI is a command-line management tool for containerized applications, open-sourced by Docker. Versions of Docker CLI prior to 29.1.5 contain security vulnerabilities. These vulnerabilities stem from an insecure search path for plugin binary files on Windows, which could allow low-privilege...

PT-2026-22939

Name of the Vulnerable Software and Affected Versions Docker CLI versions through 29.1.5 Docker Compose versions 2.31.0 through 5.0.0 Description The Docker CLI for Windows searches for plugin binaries in C:ProgramDataDockercli-plugins, a directory that does not exist by default. An attacker with...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, policy-controller, trivy-operator, helm-push, cert-manager-cmctl, crossplane-provider-azure-sql, flux-kustomize-controller, flux-helm-controller, crossplane-provider-aws-kinesis, argocd-image-updater,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, policy-controller, trivy-operator, helm-push, cert-manager-cmctl, crossplane-provider-azure-sql, flux-kustomize-controller, flux-helm-controller, crossplane-provider-aws-kinesis, argocd-image-updater,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: q, argo-events, flux-image-automation-controller, crossplane-provider-aws-cognitoidentity-fips, helm-push, sops-fips, crossplane-provider-aws-s3, helm-diff-fips, pulumi-language-yaml, gitlab-rails-ce-fips, crossplane-provider-aws-efs, crossplane-provider-aws-s3-fips,...

AZL-75413 CVE-2025-11065 affecting package docker-cli 25.0.7-1

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

[SECURITY] Fedora 41 Update: docker-buildx-0.30.1-1.fc41

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 42 Update: docker-buildx-0.30.1-1.fc42

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 43 Update: docker-buildx-0.30.1-1.fc43

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 41 Update: docker-buildx-0.29.1-1.fc41

Docker CLI plugin for extended build capabilities with BuildKit...

EUVD-2021-2512

Malware in sbrugna...

EUVD-2024-2000

Malicious code in bioql PyPI...

EUVD-2023-24414

Malicious code in bioql PyPI...

EUVD-2025-20270

Malicious code in bioql PyPI...

[SECURITY] Fedora 42 Update: podman-5.6.1-1.fc42

podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...

[SECURITY] Fedora 41 Update: docker-buildx-0.27.0-1.fc41

Docker CLI plugin for extended build capabilities with BuildKit...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: rancher-security-scan, spire-server-fips, contour, terraform-fips, s5cmd, nvidia-nsight-compute-12.9, terraform-provider-sendgrid, cert-manager-csi-driver, caddy, nvidia-container-toolkit, elvish, gitness, minio, chart-testing-fips, kots, nri-kafka,...