CVE-2026-33997

HighCVSS 8.1/10Last modified Sep 9, 2026

Description

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-193 CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Sep 9, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-339997.8A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an CVE-2026-34009.8A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /gofor CVE-2026-340009.1A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `Check CVE-2026-340017.8A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within th CVE-2026-340029.1A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handl CVE-2026-340037.8A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X CVE-2026-340058.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters CVE-2026-340069.3A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability c CVE-2026-340076.9An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attack CVE-2026-340088.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gain CVE-2026-340098.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an admini CVE-2026-34016.6A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipu