GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: prometheus-node-exporter, gatus, kubernetes-event-exporter, kustomize, ytt-fips, terraform-provider-azuread, kwok, kubewatch, cluster-api-gcp-controller-fips, longhorn-cli-fips, minc-fips, opensearch-k8s-operator, wavefront-collector-for-kubernetes, vault-benchmark,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: docker-compose, fluent-operator, knative-serving, crossplane-provider-family-azure, prometheus-adapter, ratify, jaeger, kubernetes-dns-node-cache, chartmuseum, crossplane-provider-aws-kms, ksops, kubernetes-csi-driver-hostpath, crossplane-provider-aws-cloudwatchlogs,...

CLEANSTART-2026-CO68219 Docker CLI for Windows searches for plugin binaries in C:\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ProgramData\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\Docker\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\cli-plugins, a directory that does not exist by default

Multiple security vulnerabilities affect the istio-fips package. Docker CLI for Windows searches for plugin binaries in...

CVE-2026-33748 vulnerabilities

Vulnerabilities for packages: docker-compose, osv-scanner, podman, conftest, guac, skaffold, scorecard, trivy-operator, zot, kaniko, trivy, kubescape, docker-cli-buildx, buildah...

GHSA-4VRQ-3VRQ-G6GG vulnerabilities

Vulnerabilities for packages: docker-compose, osv-scanner, podman, conftest, guac, skaffold, scorecard, trivy-operator, zot, kaniko, trivy, kubescape, docker-cli-buildx, buildah...

CVE-2026-33747 vulnerabilities

Vulnerabilities for packages: docker-compose, osv-scanner, podman, conftest, guac, skaffold, scorecard, trivy-operator, zot, kaniko, trivy, kubescape, docker-cli-buildx, buildah...

GHSA-4C29-8RGM-JVJJ vulnerabilities

Vulnerabilities for packages: docker-compose, osv-scanner, podman, conftest, guac, skaffold, scorecard, trivy-operator, zot, kaniko, trivy, kubescape, docker-cli-buildx, buildah...

GHSA-4VRQ-3VRQ-G6GG vulnerabilities

Vulnerabilities for packages: zot, cloudbeat-fips, conftest-fips, osv-scanner, trivy, buildah, podman, conftest, guac, kaniko-fips, scorecard, podman-fips, trivy-fips, skaffold-fips, kubescape-server-fips, kubescape, docker-compose-fips, docker-cli-buildx-fips, livekit-cli, docker-fips,...

CVE-2026-33748 vulnerabilities

Vulnerabilities for packages: zot, cloudbeat-fips, conftest-fips, osv-scanner, trivy, buildah, podman, conftest, guac, kaniko-fips, scorecard, podman-fips, trivy-fips, skaffold-fips, kubescape-server-fips, kubescape, docker-compose-fips, docker-cli-buildx-fips, livekit-cli, docker-fips,...

CVE-2026-33747 vulnerabilities

Vulnerabilities for packages: zot, cloudbeat-fips, conftest-fips, osv-scanner, trivy, buildah, podman, conftest, guac, kaniko-fips, scorecard, podman-fips, trivy-fips, skaffold-fips, kubescape-server-fips, kubescape, docker-compose-fips, docker-cli-buildx-fips, livekit-cli, docker-fips,...

CVE-2025-11065 affecting package docker-cli for versions less than 25.0.7-2

CVE-2025-11065 affecting package docker-cli for versions less than 25.0.7-2. A patched version of the package is available...

GO-2026-4610 Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli...

BIT-DOCKER-CLI-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries docker-compose.exe, docker-buildx.exe, etc. that are executed when a...

CVE-2025-15558 Docker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries docker-compose.exe, docker-buildx.exe, etc. that are executed when a...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element in the legacy system-wide cli-plugin path. An attacker can gain elevated privileges by placing a crafted binary in C:\ProgramData\Docker\cli-plugins directory that is searched by the application when...

Docker CLI 安全漏洞

Docker CLI is a command-line management tool for containerized applications, open-sourced by Docker. Versions of Docker CLI prior to 29.1.5 contain security vulnerabilities. These vulnerabilities stem from an insecure search path for plugin binary files on Windows, which could allow low-privilege...

PT-2026-22939

Name of the Vulnerable Software and Affected Versions Docker CLI versions through 29.1.5 Docker Compose versions 2.31.0 through 5.0.0 Description The Docker CLI for Windows searches for plugin binaries in C:ProgramDataDockercli-plugins, a directory that does not exist by default. An attacker with...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: ratify, crossplane-provider-family-azure, crossplane-provider-keycloak, crossplane-provider-aws-kms, ksops, crossplane-provider-aws-cloudwatchlogs, argo-cd, witness, cilium-cli, cert-manager-cmctl, crossplane-provider-family-aws, terraform-provider-pagerduty,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: ratify, crossplane-provider-family-azure, crossplane-provider-keycloak, crossplane-provider-aws-kms, ksops, crossplane-provider-aws-cloudwatchlogs, argo-cd, witness, cilium-cli, cert-manager-cmctl, crossplane-provider-family-aws, terraform-provider-pagerduty,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: sops, vault, terraform-provider-azuread, crossplane-provider-family-aws, flux-helm-controller-fips, cilium-cli, lazygit, trivy, witness, gitlab-runner-fips, tekton-pipelines-fips, gitea-fips, crossplane-provider-aws-ec2-fips, boring-registry-fips,...