CVE-2026-93315

The BuildKit build engine is vulnerable to a Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) when using proxy networking with CA injection. A build step can modify the CA bundle before the cleanup process occurs, potentially causing the cleanup to block, execute outside the build root...

CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

CVE-2026-97275

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-93322

A flaw was found in BuildKit. This vulnerability can lead to a Denial of Service DoS when a malicious build frontend submits a specially crafted low-level builder LLB definition. Processing this definition causes the build daemon to panic and terminate unexpectedly, interrupting all active build...

CVE-2026-93319

A flaw was found in BuildKit. An attacker using a malicious external build frontend can trigger a Denial of Service DoS by sending requests through the internal API. This request sequence induces a data race condition, causing the BuildKit daemon to crash unexpectedly and interrupt build processe...

CVE-2026-93317

A flaw was found in BuildKit. An unauthenticated remote attacker controlling a container registry or Open Container Initiative OCI blob source can provide data that does not match its claimed cryptographic digest. Because BuildKit caches the resulting snapshot under the claimed digest, subsequent...

CVE-2026-93316

A flaw was found in BuildKit. This vulnerability allows an authenticated user to cause a Denial of Service DoS by crashing the daemon. When the BuildKit daemon is started with Container Device Interface CDI support disabled, submitting a build that attempts to use CDI devices triggers an unhandle...

CVE-2026-93320

A flaw was found in BuildKit. This vulnerability allows an attacker to trick the build engine into performing file operations on special file inodes where regular files are expected. By providing a crafted build context, an attacker can block build operations leading to a Denial of Service DoS or...

CVE-2026-93319

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-93318

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

CVE-2026-93320

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-93316

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident...

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-97275

The VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin (versions n/a through 1.0.28 ) is vulnerable to Improper Validation of Specified Quantity in Input (CWE-1284). This flaw allows for Input Data Manipulation , which can be used to bypass intended logic within the ...

EUVD-2026-92589

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-93322

The buildkitd daemon is vulnerable to a Denial of Service (DoS) condition where a malicious frontend can submit a malformed LLB definition (specifically involving a malformed MergeOp ). This input causes the daemon to panic and terminate , which interrupts all active builds running on that daemon...

CVE-2026-93322 Malformed MergeOp can crash the BuildKit daemon

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...

EUVD-2026-92539

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-93320

BuildKit is vulnerable to a flaw where it may be tricked into performing file actions using special file inodes instead of the expected regular files. This behavior can lead to blocked operations or, in environments with rootful workers , potentially allow unintended host device access . No speci...

CVE-2026-93320 BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...