De multiples vulnérabilités ont été découvertes dans Docker Desktop. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-114409 CVE-2026-99999 Docker FR
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Docker Buildx. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93325.
CVSS 7.8 CVE-2026-93325 Docker US
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]
EPSS 0.00 CVE-2026-105445 Docker US
Aggiornamenti di sicurezza risolvono una vulnerabilità con gravità “alta” in Docker Desktop per Windows, applicazione per eseguire e gestire container Docker sui sistemi Windows. Tale vulnerabilità potrebbe consentire a un attaccante di eseguire codice arbitrario con privilegi elevati sui sistemi interessati.
EPSS 0.00 CVE-2026-106581 Docker IT
Rilasciati aggiornamenti di sicurezza per Docker Engine e per il modulo Go del progetto Moby che risolvono una vulnerabilità di gravità alta. Tale vulnerabilità, dovuta a un'errata gestione delle risposte DNS, potrebbe consentire a un attaccante di compromettere la sicurezza delle connessioni ai registri delle immagini container, causando la possibile esposizione delle credenziali di autenticazione o la sostituzione delle immagini legittime con contenuti malevoli.
EPSS 0.00 CVE-2026-92543 Docker IT
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]
Docker US
Aggiornamenti di sicurezza Docker sanano due vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", in Docker Sandboxes.
EPSS 0.00 CVE-2026-77179 CVE-2026-79994 Docker IT FR
Serial Number: AV26-925Date: September 15, 2026 As of September 15, 2026, Docker is affected by a vulnerability in the following product: Docker Sandboxes Prior to 0.43.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Docker sbx-releases Docker security announcements
Docker CA
Executive Summary Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan,…
PyPI npm Docker GitHub zdravotnictví veřejná správa média US
Disponibile un Proof of Concept (PoC) per lo sfruttamento della vulnerabilità identificata dalla CVE-2026-17106, già sanata dal vendor, che interessa Docker Desktop, applicazione sviluppata da Docker Inc. che fornisce un ambiente completo per eseguire e gestire container Docker su Windows e macOS.
EPSS 0.00 CVE-2026-17106 Docker IT
Information published.
EPSS 0.14 CVE-2025-62725 Docker US
This vulnerability allows local attackers to escape the model runner sandbox on affected installations of Docker Desktop for macOS. An attacker must first obtain the ability to execute low-privileged code within the sandbox in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
CVSS 8.8 Docker US
Aikido now supports Docker Hardened Images with built-in VEX integration, helping teams reduce CVE noise and focus on container vulnerabilities that actually need attention. Category: Product & Company Updates
Executive Summary SentinelLABS has identified PCPJack, a credential theft framework that worms across exposed cloud infrastructure and removes artifacts associated with TeamPCP, a threat actor persona who claimed several high-profile supply chain intrusions throughout early 2026. The toolset harvests credentials from cloud, container, developer, productivity, and financial services, then exfiltrates the data through attacker-controlled infrastructure while attempting to spread to additional…