[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-15788":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":195,"aliases":196,"duplicate_of":9,"upstream":198,"downstream":202,"duplicates":210,"related":211,"reserved_at":9,"published_at":212,"modified_at":213,"state":214,"summary":215,"references_raw":224,"kevs":287,"epss":288,"epss_history":291,"metrics":468,"affected":486},"CVE-2026-15788","BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","weakness","Draft","Base","Medium",[20,101,162,191],{"id":21,"name":22,"techniques":23},"CAPEC-132","Symlink Attack",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1547.009","Shortcut Modification",[28,31],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,45,49,53,57,62,67,71,75,80,84,88,92,96],{"id":36,"name":37,"tactic":38},"D3-LFP","Local File Permissions",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-DA","Dynamic Analysis",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":50,"name":51,"tactic":52},"D3-EFA","Emulated File Analysis",{"name":44},{"id":54,"name":55,"tactic":56},"D3-CM","Content Modification",{"name":39},{"id":58,"name":59,"tactic":60},"D3-FEV","File Eviction",{"name":61},"Evict",{"id":63,"name":64,"tactic":65},"D3-DF","Decoy File",{"name":66},"Deceive",{"id":68,"name":69,"tactic":70},"D3-FA","File Analysis",{"name":44},{"id":72,"name":73,"tactic":74},"D3-CF","Content Filtering",{"name":39},{"id":76,"name":77,"tactic":78},"D3-FE","File Encryption",{"name":79},"Harden",{"id":81,"name":82,"tactic":83},"D3-EAL","Executable Allowlisting",{"name":39},{"id":85,"name":86,"tactic":87},"D3-EDL","Executable Denylisting",{"name":39},{"id":89,"name":90,"tactic":91},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":93,"name":94,"tactic":95},"D3-CQ","Content Quarantine",{"name":39},{"id":97,"name":98,"tactic":99},"D3-RF","Restore File",{"name":100},"Restore",{"id":102,"name":103,"techniques":104},"CAPEC-17","Using Malicious Files",[105,142],{"id":106,"name":107,"tactics":108,"countermeasures":120},"T1574.005","Executable Installer File Permissions Weakness",[109,110,111,114,117],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},"TA0030","Defense Evasion",{"id":115,"name":116},"TA0005","Stealth",{"id":118,"name":119},"TA0104","Execution",[121,125,129,134,138],{"id":122,"name":123,"tactic":124},"D3-SU","Software Update",{"name":79},{"id":126,"name":127,"tactic":128},"D3-RS","Restore Software",{"name":100},{"id":130,"name":131,"tactic":132},"D3-AVE","Asset Vulnerability Enumeration",{"name":133},"Model",{"id":135,"name":136,"tactic":137},"D3-SWI","Software Inventory",{"name":133},{"id":139,"name":140,"tactic":141},"D3-SBV","Service Binary Verification",{"name":44},{"id":143,"name":144,"tactics":145,"countermeasures":151},"T1574.010","Services File Permissions Weakness",[146,147,148,149,150],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[152,154,156,158,160],{"id":126,"name":127,"tactic":153},{"name":100},{"id":135,"name":136,"tactic":155},{"name":133},{"id":139,"name":140,"tactic":157},{"name":44},{"id":130,"name":131,"tactic":159},{"name":133},{"id":122,"name":123,"tactic":161},{"name":79},{"id":163,"name":164,"techniques":165},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[166,173,180],{"id":167,"name":168,"tactics":169,"countermeasures":172},"T1027.006","HTML Smuggling",[170,171],{"id":112,"name":113},{"id":115,"name":116},[],{"id":174,"name":175,"tactics":176,"countermeasures":179},"T1027.009","Embedded Payloads",[177,178],{"id":112,"name":113},{"id":115,"name":116},[],{"id":181,"name":182,"tactics":183,"countermeasures":186},"T1564.009","Resource Forking",[184,185],{"id":112,"name":113},{"id":115,"name":116},[187],{"id":188,"name":189,"tactic":190},"D3-FFV","File Format Verification",{"name":39},{"id":192,"name":193,"techniques":194},"CAPEC-76","Manipulating Web Input to File System Calls",[],[],[197],"RHSA-2026:43122",[199,200],{"_key":7},{"_key":201},"CVE-2026-15792",[203,204,206,208],{"_key":7},{"_key":205},"RHSA-2026:44152",{"_key":207},"RHSA-2026:46988",{"_key":209},"RHSA-2026:51065",[],[],"2026-07-20T19:12:56.386Z","2026-07-21T12:40:56.055Z","Analyzed",{"cisa_kev":216,"cisa_ransomware":216,"cisa_vendor":9,"epss_severity":217,"epss_score":218,"severity":219,"severity_score":220,"severity_version":221,"severity_source":222,"severity_vector":223,"severity_status":214},false,"low",0.00274,"high",7.5,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",[225,233,238,243,247,251,255,259,263,267,271,275,279,283],{"url":226,"sources":227,"tags":230},"https://github.com/moby/buildkit/security/advisories/GHSA-388v-wmr2-g2v2",[228,222,229],"cve.org","osv_red_hat",[231,232],"Vendor Advisory","ARTICLE",{"url":234,"sources":235,"tags":236},"https://access.redhat.com/errata/RHSA-2026:43122",[229],[237],"Advisory",{"url":239,"sources":240,"tags":241},"https://access.redhat.com/security/cve/CVE-2026-15788",[229],[242],"REPORT",{"url":244,"sources":245,"tags":246},"https://access.redhat.com/security/updates/classification/",[229],[232],{"url":248,"sources":249,"tags":250},"https://images.redhat.com/",[229],[232],{"url":252,"sources":253,"tags":254},"https://access.redhat.com/security/cve/CVE-2026-15792",[229],[232,242],{"url":256,"sources":257,"tags":258},"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43122.json",[229],[237],{"url":260,"sources":261,"tags":262},"https://bugzilla.redhat.com/show_bug.cgi?id=2502989",[229],[242],{"url":264,"sources":265,"tags":266},"https://www.cve.org/CVERecord?id=CVE-2026-15788",[229],[237],{"url":268,"sources":269,"tags":270},"https://nvd.nist.gov/vuln/detail/CVE-2026-15788",[229],[237],{"url":272,"sources":273,"tags":274},"https://bugzilla.redhat.com/show_bug.cgi?id=2503746",[229],[242],{"url":276,"sources":277,"tags":278},"https://www.cve.org/CVERecord?id=CVE-2026-15792",[229],[237],{"url":280,"sources":281,"tags":282},"https://nvd.nist.gov/vuln/detail/CVE-2026-15792",[229],[237],{"url":284,"sources":285,"tags":286},"https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6",[229],[232],[],{"date":289,"score":218,"percentile":290},"2026-09-19",0.20051,[292,296,299,302,304,306,309,312,315,318,321,324,327,330,333,336,339,342,345,348,351,354,357,360,363,366,369,372,375,378,381,384,387,390,393,396,399,402,404,407,410,413,416,419,422,425,428,431,433,435,438,441,444,447,450,453,456,459,462,465,467],{"date":293,"score":294,"percentile":295},"2026-07-21",0.00145,0.04222,{"date":297,"score":294,"percentile":298},"2026-07-22",0.04238,{"date":300,"score":294,"percentile":301},"2026-07-23",0.04224,{"date":303,"score":294,"percentile":295},"2026-07-24",{"date":305,"score":294,"percentile":295},"2026-07-25",{"date":307,"score":294,"percentile":308},"2026-07-26",0.04219,{"date":310,"score":294,"percentile":311},"2026-07-27",0.04231,{"date":313,"score":294,"percentile":314},"2026-07-28",0.04229,{"date":316,"score":294,"percentile":317},"2026-07-29",0.04246,{"date":319,"score":294,"percentile":320},"2026-07-30",0.04276,{"date":322,"score":294,"percentile":323},"2026-07-31",0.04285,{"date":325,"score":294,"percentile":326},"2026-08-01",0.04275,{"date":328,"score":294,"percentile":329},"2026-08-02",0.04266,{"date":331,"score":294,"percentile":332},"2026-08-03",0.04265,{"date":334,"score":294,"percentile":335},"2026-08-04",0.04264,{"date":337,"score":294,"percentile":338},"2026-08-05",0.04257,{"date":340,"score":218,"percentile":341},"2026-08-06",0.19505,{"date":343,"score":218,"percentile":344},"2026-08-07",0.19514,{"date":346,"score":218,"percentile":347},"2026-08-08",0.19519,{"date":349,"score":218,"percentile":350},"2026-08-09",0.19513,{"date":352,"score":218,"percentile":353},"2026-08-10",0.19511,{"date":355,"score":218,"percentile":356},"2026-08-11",0.19604,{"date":358,"score":218,"percentile":359},"2026-08-12",0.19645,{"date":361,"score":218,"percentile":362},"2026-08-13",0.19669,{"date":364,"score":218,"percentile":365},"2026-08-14",0.19684,{"date":367,"score":218,"percentile":368},"2026-08-15",0.19838,{"date":370,"score":218,"percentile":371},"2026-08-16",0.19871,{"date":373,"score":218,"percentile":374},"2026-08-17",0.19789,{"date":376,"score":218,"percentile":377},"2026-08-18",0.19807,{"date":379,"score":218,"percentile":380},"2026-08-19",0.19875,{"date":382,"score":218,"percentile":383},"2026-08-20",0.199,{"date":385,"score":218,"percentile":386},"2026-08-21",0.19923,{"date":388,"score":218,"percentile":389},"2026-08-22",0.19931,{"date":391,"score":218,"percentile":392},"2026-08-23",0.19925,{"date":394,"score":218,"percentile":395},"2026-08-24",0.19247,{"date":397,"score":218,"percentile":398},"2026-08-25",0.19262,{"date":400,"score":218,"percentile":401},"2026-08-26",0.19327,{"date":403,"score":218,"percentile":401},"2026-08-27",{"date":405,"score":218,"percentile":406},"2026-08-28",0.19363,{"date":408,"score":218,"percentile":409},"2026-08-29",0.19383,{"date":411,"score":218,"percentile":412},"2026-08-30",0.19401,{"date":414,"score":218,"percentile":415},"2026-08-31",0.19382,{"date":417,"score":218,"percentile":418},"2026-09-01",0.19405,{"date":420,"score":218,"percentile":421},"2026-09-02",0.19423,{"date":423,"score":218,"percentile":424},"2026-09-03",0.19431,{"date":426,"score":218,"percentile":427},"2026-09-04",0.19456,{"date":429,"score":218,"percentile":430},"2026-09-05",0.19497,{"date":432,"score":218,"percentile":353},"2026-09-06",{"date":434,"score":218,"percentile":344},"2026-09-07",{"date":436,"score":218,"percentile":437},"2026-09-08",0.19523,{"date":439,"score":218,"percentile":440},"2026-09-09",0.1964,{"date":442,"score":218,"percentile":443},"2026-09-10",0.19638,{"date":445,"score":218,"percentile":446},"2026-09-11",0.19648,{"date":448,"score":218,"percentile":449},"2026-09-12",0.19754,{"date":451,"score":218,"percentile":452},"2026-09-13",0.1971,{"date":454,"score":218,"percentile":455},"2026-09-14",0.19727,{"date":457,"score":218,"percentile":458},"2026-09-15",0.19796,{"date":460,"score":218,"percentile":461},"2026-09-16",0.19868,{"date":463,"score":218,"percentile":464},"2026-09-17",0.19911,{"date":466,"score":218,"percentile":290},"2026-09-18",{"date":289,"score":218,"percentile":290},[469,474,481],{"source":228,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":470},{"baseScore":471,"baseSeverity":472,"vectorString":473,"impactScore":9,"exploitabilityScore":9},5.6,"MEDIUM","CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",{"source":222,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":475,"cvss_v4_0":479},{"baseScore":220,"baseSeverity":476,"vectorString":223,"impactScore":477,"exploitabilityScore":478},"HIGH",6,10,{"baseScore":471,"baseSeverity":472,"vectorString":480,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":229,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":482,"cvss_v4_0":9},{"baseScore":483,"baseSeverity":9,"vectorString":484,"impactScore":477,"exploitabilityScore":485},6.5,"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",7.2,[487,497,503],{"ecosystem":9,"name":488,"vendor":489,"product":488,"cpe_part":490,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":491},"buildkit","moby","a",[492],{"version":493,"is_range":494,"range_type":228,"version_start":9,"version_start_type":9,"version_end":495,"version_end_type":496,"fixed_in":9},"\u003C 0.31.2",true,"0.31.2","excluding",{"ecosystem":9,"name":488,"vendor":498,"product":488,"cpe_part":490,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":499},"mobyproject",[500],{"version":501,"is_range":494,"range_type":502,"version_start":9,"version_start_type":9,"version_end":495,"version_end_type":496,"fixed_in":9},"lt0.31.2","cpe",{"ecosystem":504,"name":505,"vendor":506,"product":505,"cpe_part":9,"purl_type":507,"purl_namespace":506,"purl_name":505,"source":9,"versions":508},"Red Hat","buildah","redhat","rpm",[509],{"version":510,"is_range":494,"range_type":511,"version_start":9,"version_start_type":9,"version_end":512,"version_end_type":496,"fixed_in":9},"lt0:1_44_0_3_2_hum1","ecosystem","0:1.44.0-3.2.hum1"]