Most recent entries from all

bdu:2026-07149

BELL-CVE-2026-33747

Affected: Alpaquita:stream: docker

CLEANSTART-2026-DU09908 — BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

Affected: CleanStart: docker-cli-buildx

Security vulnerability affects the docker-cli-buildx package. BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

EUVD-2026-277883

fkie_cve-2026-33747

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

GHSA-4c29-8rgm-jvjj — BuildKit's Malicious frontend can cause file escape outside of storage root

Affected: Go: github.com/moby/buildkit

### Impact When using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context.

### Patches The issue has been fixed in v0.28.1+

### Workarounds Issue requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.

openSUSE-SU-2026:10456-1 — tailscale-1.96.4-1.1 on GA media

tailscale-1.96.4-1.1 on GA media

RHSA-2026:10125 — Red Hat Security Advisory: RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

SUSE-SU-2026:21851-1 — Security update for docker-stable

Security update for docker-stable

UBUNTU-CVE-2026-33747

Affected: Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:Pro:18.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:22.04:LTS: docker.io-app, Ubuntu:Pro:22.04:LTS: docker.io, Ubuntu:24.04:LTS: docker.io-app, Ubuntu:Pro:24.04:LTS: docker.io, Ubuntu:25.10: docker.io, Ubuntu:25.10: docker.io-app and 2 more

WID-SEC-W-2026-0873 — docker: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in docker ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.