Docker · product
Docker Sandboxes
12 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.
- Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory
- Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
- Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
- Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts
- Docker Sandboxes read-only runtime mount writable through its shared-export alias
- Docker Sandboxes ICMP egress restriction bypass after daemon restart
- Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race
- Docker Sandboxes host Git executes repository-controlled programs
- Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
- Docker Sandboxes restores removed automatically assigned port publications
- Docker Sandboxes privilege escalation through untrusted state directories
- Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.