Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Docker Desktop — Vulnerabilities & Security Advisories 25

All 25 CVE vulnerabilities found in Docker Desktop, with AI-generated Chinese analysis, references, and POCs.

Vendor: Docker Inc.

CVE IDTitleCVSSSeverityPublished
CVE-2026-2664 Out of bounds read vulnerability in grpcfuse kernel module CWE-125 7.1AIHighAI2026-02-24
CVE-2025-14740 Docker Desktop for Windows Incorrect Permission Assignment Privilege Escalation Vulnerabilities CWE-732 6.7 Medium2026-02-04
CVE-2025-13743 Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs CWE-532 7.5AIHighAI2025-12-09
CVE-2025-9164 Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows CWE-427 7.8AIHighAI2025-10-27
CVE-2025-10657 Docker Desktop with ECI Fails to Enforce Socket Command Restrictions CWE-269 7.2 -2025-09-26
CVE-2025-9074 Docker Desktop allows unauthenticated access to Docker Engine API from containers CWE-668 8.1AIHighAI2025-08-20
CVE-2025-6587 Exposure of system environment variables in Docker Desktop diagnostic logs CWE-532 6.5AIMediumAI2025-07-03
CVE-2025-3911 Exposure in Docker Desktop logs of environment variables configured for running containers CWE-532 5.5AIMediumAI2025-04-29
CVE-2025-4095 Registry Access Management (RAM) policies not applied when sign-in enforcement is configured via a configuration profile CWE-862 6.1AIMediumAI2025-04-29
CVE-2025-3224 Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion CWE-269 7.8AIHighAI2025-04-28
CVE-2025-1696 Exposure of Proxy Credentials in Docker Desktop Logs CWE-532 4.3 -2025-03-06
CVE-2024-9348 Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view CWE-20 9.8AICriticalAI2024-10-16
CVE-2024-8696 A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2. CWE-79 8.8AIHighAI2024-09-12
CVE-2024-8695 A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2. CWE-79 9.8AICriticalAI2024-09-12
CVE-2024-6222 In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages CWE-923 7.8AIHighAI2024-07-09
CVE-2024-5652 In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode 6.1 Medium2024-07-09
CVE-2023-0633 In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPE CWE-88 7.2 High2023-09-25
CVE-2023-0627 Docker Desktop 4.11.x allows --no-windows-containers flag bypass CWE-501 6.7 Medium2023-09-25
CVE-2023-0626 Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route CWE-94 8.0 High2023-09-25
CVE-2023-0625 Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog CWE-79 8.0 High2023-09-25
CVE-2023-5166 Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL CWE-200 8.0 High2023-09-25
CVE-2023-5165 Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell CWE-862 7.1 High2023-09-25
CVE-2023-1802 In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed CWE-319 5.9 Medium2023-04-06
CVE-2023-0629 Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers CWE-424 7.1 High2023-03-13
CVE-2023-0628 Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL CWE-77 6.1 Medium2023-03-13

All 25 known CVE vulnerabilities affecting Docker Desktop with full Chinese analysis, references, and POCs where available.