Go github.com/moby/moby

Name: Go github.com/moby/moby
Brand: Go

productUS

pkg:golang/github.com/moby/moby

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

1critical4high7medium0low

updated 2026-10-28

vulnerabilities (18)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-14271US	critical9.8	18.8% (97th)	Exploit	20.10.0-beta1+incompatible	2019-07-29	< 20.10.0-beta1+incompatible
CVE-2024-41110US	—OT elevated	16.5% (97th)	Exploit	26.1.5+incompatible	2024-07-24	3 versions
CVE-2026-34040US	high7.8OT elevated	9.11% (95th)	Exploit	29.3.1	2026-03-31	2 versions
CVE-2021-41091US	medium6.3	2.85% (87th)	Exploit	20.10.9	2021-10-04	2 versions
CVE-2026-41567US	—	0.15% (5th)	Exploit	no fix	2026-06-05	2 versions
CVE-2021-21285US	medium6.5	3.29% (88th)	—	19.3.15	2021-02-02	2 versions
CVE-2017-16539US	medium5.9	1.83% (79th)	—	17.12.0-ce	2017-11-04	< 17.12.0-ce
CVE-2020-27534US	medium5.3	1.77% (78th)	—	19.03.9	2020-12-30	< 19.03.9
CVE-2021-21284US	medium6.8	1.06% (65th)	—	20.10.3	2021-02-02	2 versions
CVE-2024-36620US	—	0.82% (57th)	—	26.1.0+incompatible	2024-11-29	2 versions
CVE-2024-36623US	—	0.64% (51st)	—	26.0.0+incompatible	2024-11-29	2 versions
CVE-2024-36621US	—	0.63% (50th)	—	26.0.0+incompatible	2024-11-29	2 versions
CVE-2022-24769US	medium5.9	0.49% (42nd)	—	20.10.14	2022-03-24	2 versions
CVE-2026-33997US	high8.1	0.39% (33rd)	—	no fix	2026-03-31	—
CVE-2021-41089US	medium6.3	0.29% (21st)	—	20.10.9+incompatible	2021-10-04	< 20.10.9+incompatible
CVE-2024-24557US	high7.8OT elevated	0.26% (18th)	—	25.0.2+incompatible	2024-02-01	4 versions
CVE-2026-41568US	—	0.11% (1st)	—	no fix	2026-06-12	2 versions
CVE-2026-42306US	high7.2	0.10% (1st)	—	no fix	2026-06-12	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-281Improper Preservation of Permissions2 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2 CVEs
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition2 CVEs
CWE-61UNIX Symbolic Link (Symlink) Following2 CVEs
CWE-732Incorrect Permission Assignment for Critical Resource2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-187Partial String Comparison1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.