poslední zpráva · zachyceno
SPOJENO AI EPSS < 0.01 (nejvyšší)
Vulnerability in Docker Sandboxes
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 7.1, CVEs: CVE-2026-121614, Summary: Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an…
Docker FI CA IT
CVE v události 4
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-103916 | 8.4 4.0 · Docker | – | < 0.01 |
| CVE-2026-112917 | 9.2 4.0 · Docker | – | < 0.01 |
| CVE-2026-121614 | 7.1 4.0 · Docker | – | < 0.01 |
| CVE-2026-93325 | 7.3 4.0 · Docker | – | < 0.01 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 7.1.
Jak se o tom psalo 3
-
· zachyceno · NCSC-FI FI nadpis události
Vulnerability in Docker Sandboxes
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 7.1, CVEs: CVE-2026-121614, Summary: Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an…
-
· Cyber Centre Kanada CA
Docker security advisory (AV26-1123)
Serial number: AV26-1123 Date: November 4, 2026 As of November 3, 2026, Docker is affected by vulnerabilities in the following products: Docker Buildx Prior to 0.37.2 Docker Desktop Prior to 4.98.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Docker Desktop release notes Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx Docker security announcements
-
· CSIRT Itálie (ACN) IT
Risolte vulnerabilità in prodotti Docker
Rilasciati aggiornamenti di sicurezza per sanare alcune vulnerabilità, di cui una con gravità “critica” e 3 con gravità “alta”, nei prodotti Docker Sandboxes, Docker Buildx e Docker Desktop. Tali vulnerabilità potrebbero consentire a un utente malintenzionato locale di eseguire codice arbitrario sul sistema host al di fuori dell'ambiente isolato ed eludere le restrizioni applicate ai container per accedere a servizi e file sul sistema host.