CVE-2026-2664

< 4.62.0

An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and

7.8HIGH

CVE-2025-13743

>= 4.51.0 and < 4.54.0

Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This po

7.5HIGH

CVE-2025-3224

< 4.41.0

A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged

7.8HIGH

CVE-2024-8696

< 4.34.2

A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious ext

9.8CRITICAL

CVE-2024-8695

< 4.34.2

A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension i

9.8CRITICAL

CVE-2024-6222

< 4.29.0

In Docker Desktop before v4.29.0, an attacker who has gained access to the Docker Desktop VM through a container breakout can furt

7.0HIGH

CVE-2024-5652

< 4.31.0

In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through

6.1MEDIUM

CVE-2023-5166

< 4.23.0

Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URL. This issue affects Docker Desktop: befor

8.0HIGH

CVE-2023-5165

>= 4.13.0 and < 4.23.0

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug s

7.1HIGH

CVE-2023-0633

< 4.12.0

In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in local privilege escalation (LPE).This

7.2HIGH

CVE-2023-0627

>= 4.11.0 and < 4.12.0

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escal

6.7MEDIUM

CVE-2023-0626

< 4.12.0

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: b

8.0HIGH

CVE-2023-0625

< 4.12.0

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Des

8.0HIGH

CVE-2022-38730

< 4.6.0

Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 A

6.3MEDIUM

CVE-2022-37326

< 4.6.0

Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontain

7.8HIGH

CVE-2022-34292

< 4.6.0

Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create docke

7.1HIGH

CVE-2022-31647

< 4.6.0

Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a sy

7.1HIGH

CVE-2023-1802

all versions

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS healt

5.9MEDIUM

CVE-2023-0629

>= 4.13.0 and < 4.17.0

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the

7.1HIGH

CVE-2023-0628

< 4.17.0

Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initial

6.1MEDIUM

CVE-2021-44719

< 4.5.0

Docker Desktop 4.3.0 has Incorrect Access Control.

8.4HIGH

CVE-2022-26659

< 4.6.0

Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by c

7.1HIGH

CVE-2022-23774

< 4.4.4

Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.

5.3MEDIUM

CVE-2021-45449

all versions

Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machi

5.5MEDIUM

CVE-2021-37841

< 3.6.0

Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server runnin

7.8HIGH

CVE-2020-15360

all versions

com.docker.vmnetd in Docker Desktop 2.3.0.3 allows privilege escalation because of a lack of client verification.

7.8HIGH

CVE-2020-11492

<= 2.2.0.5

An issue was discovered in Docker Desktop through 2.2.0.5 on Windows. If a local attacker sets up their own named pipe prior to st

7.8HIGH

CVE-2020-10665

< 2.2.2.0

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with A

6.7MEDIUM