Docker security note

CVE-2025-64443 — Open the advisory

MCP Gateway allows easy and secure running and deployment of MCP servers.

Affected: <= 0.27.0

CVE-2026-95837 — Check if you run it

containerd CRI plugin: Checkpoint restore bypasses destination security context

Affected: 2.1.0 → 2.2.7, 2.3.0 → 2.3.4, >= 2.1.0, < 2.2.7

CVE-2026-95838 — Check if you run it

containerd: Unpack DoS via repeated opaque whiteouts

Affected: < 1.7.35, <1.7.35, < 2.0.12, >= 2.2.0

SUSE-SU-2026:24136-1 — Open the advisory

Security update for containerd

Affected: 0 → 1.7.29-159998.1.1

SUSE-SU-2026:4671-1 — Open the advisory

Security update for containerd

Affected: 0 → 1.7.29-16.116.1

CVE-2026-42596 — Patch now

Gotenberg is a Docker-powered stateless API for PDF files.

No version range is stored, so an installed version cannot be checked.

CVE-2026-73802 — Check if you run it

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled.

No version range is stored, so an installed version cannot be checked.

CVE-2026-105039 — Check if you run it

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.

No version range is stored, so an installed version cannot be checked.

CVE-2026-47218 — Check if you run it

runwasi facilitates running Wasm and WASI workloads managed by containerd.

No version range is stored, so an installed version cannot be checked.

CVE-2025-13743 — Check if you run it

Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization.

No version range is stored, so an installed version cannot be checked.

CVE-2026-86002 — Check if you run it

Dokku is a docker-powered platform as a service.

No version range is stored, so an installed version cannot be checked.