https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T22:35:27.082501+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33748 CVE-2026-33748 — BuildKit Git URL subdir component can cause access to restricted files 2026-10-14T22:35:27.085158+00:00

Affected: moby buildkit

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

 https://cve.radiocsirt.org/vuln/usn-8230-1 USN-8230-1 — docker.io-app vulnerabilities 2026-10-14T22:35:27.085245+00:00

Affected: Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:22.04:LTS: docker.io-app, Ubuntu:24.04:LTS: docker.io-app, Ubuntu:26.04:LTS: docker.io-app

It was discovered that BuildKit, contained within Docker, incorrectly handled file path validation when processing frontend API messages. An attacker could possibly use this issue to write files outside of the intended state directory. (CVE-2026-33747)

It was discovered that BuildKit, contained within Docker, incorrectly validated the subdir component of Git URL fragments. An attacker could possibly use this issue to access files outside of the checked-out repository root. (CVE-2026-33748)