Docker · weakness class
Information Disclosure
12 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.
- In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug lo…
- Docker CLI leaks private registry credentials to registry-1.docker.io
- Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL
- Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they…
- Expired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs
- Secrets leakage to telemetry endpoint via cache backend configuration via buildx
- Exposure of Proxy Credentials in Docker Desktop Logs
- Exposure in Docker Desktop logs of environment variables configured for running containers
- Exposure of system environment variables in Docker Desktop diagnostic logs
- Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts
- Docker Desktop logs can expose the Docker Hub access token
- Docker Desktop logs can expose stored third-party credentials
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.