Docker vulnerabilities3 known to be exploited.
Docker has 101 published vulnerabilities across 31 products in our catalogue. 3 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Docker, with 53. If you run Docker software, patch the exploited flaws first.
The most recent Docker flaw added to the known-exploited list is CVE-2026-102489, on 2 October 2026. We keep watching the known-exploited list.
Which Docker products have the most vulnerabilities?
Docker leads with 53 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Docker vulnerabilities are being exploited?
3 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.4Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user.
- 9.4Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root.
- 7.8Docker Desktop Community Edition Privilege Escalation Vulnerability
Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.
Which Docker flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 98%CVE-2019-5736High
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command...
- 49%
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user,...
- 19%CVE-2019-14271Critical
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
- 7.3%CVE-2014-0048Critical
An issue was found in Docker before 1.6.0.
- 6.2%CVE-2014-9357Critical
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
- 4.9%CVE-2014-9356High
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a...
- 4.9%CVE-2014-6407High
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
- 4.4%CVE-2019-16884High
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker...
- 3.7%CVE-2019-13509High
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log.
- 3.4%CVE-2018-15664High
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host...
All Docker products we track.
30 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Dockerdocker53 vulnerabilities193 versions
- Docker Desktopdocker_desktop14 vulnerabilities121 versions
- Desktopdesktop12 vulnerabilities135 versions
- Cs Enginecs_engine2 vulnerabilities6 versions
- Engineengine2 vulnerabilities124 versions
- Libcontainerlibcontainer2 vulnerabilities1 version
- Notarynotary2 vulnerabilities3 versions
- Admineradminer1 vulnerability10 versions
- Command Line Interfacecommand_line_interface1 vulnerability141 versions
- Composer Docker Imagecomposer_docker_image1 vulnerability31 versions
- Credential Helperscredential_helpers1 vulnerability13 versions
- Crux Linux Docker Imagecrux_linux_docker_image1 vulnerability4 versions
- Docker-Pydocker-py1 vulnerability1 version
- Docsdocs1 vulnerability1 version
- Elixir Alpine Docker Imageelixir_alpine_docker_image1 vulnerability14 versions
- Ghost Alpine Docker Imageghost_alpine_docker_image1 vulnerability130 versions
- Haproxy Docker Imagehaproxy_docker_image1 vulnerability8 versions
- Machinemachine1 vulnerability30 versions
- Memcached Docker Imagememcached_docker_image1 vulnerability1 version
- Notary Docker Imagenotary_docker_image1 vulnerability10 versions
- Rabbitmq Docker Imagerabbitmq_docker_image1 vulnerability1 version
- Registryregistry1 vulnerability6 versions
- Spiped Alpine Docker Imagespiped_alpine_docker_image1 vulnerability1 version
- Storm Docker Imagestorm_docker_image1 vulnerability21 versions
This directory lists the 30 Docker products with at least one tracked version, of 31 in our catalogue.
Running Docker? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
- Matched to
- Docker on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 101 published vulnerabilities across 31 products and 1,184 versions from Docker. The most recent Docker flaw added to the known-exploited list is CVE-2026-102489, on 2 October 2026.
3 Docker vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-102489, CVE-2026-102490 and CVE-2019-15752. The full list is on this page.
Docker, with 53 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Docker products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.