How many mobyproject buildkit CVEs are in CISA KEV?

None of mobyproject buildkit's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for mobyproject buildkit vulnerabilities?

Yes — 1 of mobyproject buildkit's CVEs have a known public exploit.

Which versions of mobyproject buildkit are affected?

9 distinct mobyproject buildkit versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in mobyproject buildkit CVEs?

mobyproject buildkit's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-59 (Improper Link Resolution Before File Access ('Link Following')), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')), CWE-754 (Improper Check for Unusual or Exceptional Conditions).

How many critical mobyproject buildkit vulnerabilities are there?

mobyproject buildkit has 3 critical and 2 high-severity CVEs.

What is the average severity of mobyproject buildkit CVEs?

The average CVSS base score across mobyproject buildkit's scored CVEs is 7.2.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Mobyproject
Buildkit

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Mobyproject
Buildkit

mobyproject buildkit Vulnerabilities: CVEs, CISA KEV & Security Advisories

mobyproject

12 CVEs

mobyproject buildkit Vulnerabilities

Name: mobyproject buildkit vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for buildkit by mobyproject.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.2

Avg CVSS

2023–2026

Last updated July 21, 2026

Overview

mobyproject buildkit has 12 published CVE records since 2023, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

Severity and exploitation

How the CVSS severity of mobyproject buildkit's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical3

High2

Medium6

Low1

In CISA’s Known Exploited Vulnerabilities catalog

None of mobyproject buildkit's CVEs are currently listed in CISA's KEV catalog.

Public exploits

One of mobyproject buildkit's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every mobyproject buildkit version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 0.12.54 CVEs
< 0.31.24 CVEs
< 0.28.12 CVEs
0.10.0 <= v < 0.11.41 CVE
0.30.0 <= v < 0.31.21 CVE

Fixed in

0.31.25 CVEs
0.12.54 CVEs
0.28.12 CVEs
0.11.41 CVE

Find a version

12 CVEs

Sort

Git source checkout from a bundle file could lead to command injection
CVE-2026-15793
Patch
Workaround
CWE-88
Medium · CVSS 6.5
EPSS 0.2% (9th pct)2026-07-21
Possible panic when incorrect parameters sent from frontend
CVE-2026-15792
Patch
Workaround
CWE-20
Medium · CVSS 6.3
EPSS 0.2% (14th pct)2026-07-21
LLB file operation can be tricked to remove /tmp directory contents
CVE-2026-15791
Patch
Workaround
CWE-22
Low · CVSS 3.3
EPSS 0.2% (15th pct)2026-07-21
Malicious client can bypass destination directory validation on local sources upload
CVE-2026-15789
Patch
Workaround
CWE-22
Medium · CVSS 6.9
EPSS 0.3% (23th pct)2026-07-21
WCOW cache mount source selector resolves NTFS junctions outside of cache root
CVE-2026-15788
Patch
Workaround
CWE-59
Medium · CVSS 5.6
EPSS 0.4% (34th pct)2026-07-20
BuildKit Git URL subdir component can cause access to restricted files
CVE-2026-33748
Patch
CWE-59
High · CVSS 8.2
EPSS 0.5% (44th pct)2026-03-27
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
CVE-2026-33747
Patch
CWE-22
Critical · CVSS 9.8
EPSS 0.6% (47th pct)2026-03-27
Buildkit's interactive containers API does not validate entitlements check
CVE-2024-23653
Patch
CWE-863
Critical · CVSS 9.8
EPSS 3.4% (89th pct)2024-01-31
BuildKit possible host system access from mount stub cleaner
CVE-2024-23652
Patch
CWE-22
Critical · CVSS 10.0
EPSS 2.5% (84th pct)2024-01-31
BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts
CVE-2024-23651
Patch
CWE-362
High · CVSS 8.7
EPSS 0.9% (59th pct)2024-01-31
BuildKit possible panic when incorrect parameters sent from frontend
CVE-2024-23650
Patch
CWE-754
Medium · CVSS 5.3
EPSS 1.1% (66th pct)2024-01-31
Buildkit credentials inlined to Git URLs could end up in provenance attestation
CVE-2023-26054
Public exploit
Patch
CWE-200
Medium · CVSS 6.5
EPSS 1.0% (63th pct)2023-03-06

Common weakness types

The CWE weakness categories most often found in mobyproject buildkit CVEs. Follow any weakness for its full explanation.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')2 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1 CVE
CWE-754Improper Check for Unusual or Exceptional Conditions1 CVE
CWE-863Incorrect Authorization1 CVE

Disclosure activity by year

How many mobyproject buildkit CVEs were published each year.

2023

2024

2026

Other mobyproject products

Browse vulnerabilities for other products by mobyproject.

moby21 CVEs hyperkit5 CVEs moby/v22 CVEs

All mobyproject vulnerabilities

Frequently asked questions

Common questions about mobyproject buildkit vulnerabilities.

How many CVEs does mobyproject buildkit have?: mobyproject buildkit has 12 published CVE records since 2023.
How many mobyproject buildkit CVEs are in CISA KEV?: None of mobyproject buildkit's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for mobyproject buildkit vulnerabilities?: Yes — 1 of mobyproject buildkit's CVEs have a known public exploit.
Which versions of mobyproject buildkit are affected?: 9 distinct mobyproject buildkit versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in mobyproject buildkit CVEs?: mobyproject buildkit's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-59 (Improper Link Resolution Before File Access ('Link Following')), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')), CWE-754 (Improper Check for Unusual or Exceptional Conditions).
How many critical mobyproject buildkit vulnerabilities are there?: mobyproject buildkit has 3 critical and 2 high-severity CVEs.
What is the average severity of mobyproject buildkit CVEs?: The average CVSS base score across mobyproject buildkit's scored CVEs is 7.2.

References

All mobyproject vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track mobyproject buildkit vulnerabilities

Get an alert for each new mobyproject buildkit CVE, with AI-written analysis and remediation steps.

Create an account See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References

CWE-20Improper Input Validation

1 CVE

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')1 CVE

CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVE