DaystoPatch

VendorsDev tools

Docker

Docker makes container tooling, including Docker Desktop, Docker Engine (from the Moby project), Docker Hub and BuildKit.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
none on record
Incidents on record
0

Response to exploited bugs

Not rated. No reviewed zero-days yet.

Fixing privately reported bugs

73 range 63–84rank 9 of 20

Provisional Wide range: 63–84.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
  • Fixing privately reported bugs: B- (73), provisional. Median 111 days from private report to ZDI's public advisory (16 cases). 7 of 16 took longer than ZDI's 120-day deadline. ZDI published 4 before a fix was available. ZDI also does this when a vendor declines to fix. 13 of 16 concern Desktop.
  • No exploited incidents on record for the last 36 months.

Response to exploited bugs: sub-scores

  • Time to first advisoryNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to first fixNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to fix all versionsNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • OpennessAdvisories available by RSS
    62
    5 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 111 days from private report to ZDI's public advisory (16 cases, 4 published without a fix)
    73B−
    16 cases, low confidence, weight 100%

Response fingerprint

No exploited incidents on record in the last 24 months.

Private reports

Median 111 days, 44% over 120 days, 4 published unpatched

Bugs reported privately to Docker by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
15 Oct 2026ZDI-26-758CVE-2026-93325Buildx78to publicationYes
23 Jul 2026ZDI-26-451Desktop148to publicationYes
24 Jun 2026ZDI-26-363CVE-2026-55887MCP Plugin35to publicationYes
3 Jun 2026ZDI-26-327CVE-2026-8936Desktop34to publicationYes
23 Apr 2026ZDI-26-299CVE-2026-6406Desktop104to publicationYes
15 Apr 2026ZDI-26-261Desktop278to publicationNo, published unpatched
15 Apr 2026ZDI-26-260Desktop279to publicationNo, published unpatched
15 Apr 2026ZDI-26-123, ZDI-26-259Desktop280to publicationNo, published unpatched
15 Apr 2026ZDI-26-258Desktop322to publicationNo, published unpatched
6 Mar 2026ZDI-26-152CVE-2025-15558Docker141to publicationYes
Show all 16 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
3 Mar 2026ZDI-26-150CVE-2026-28400Desktop118to publicationYes
25 Feb 2026ZDI-26-125CVE-2026-2664Desktop69to publicationYes
5 Feb 2026ZDI-26-067, ZDI-26-068CVE-2025-14740Desktop83to publicationYes
21 May 2025ZDI-25-306CVE-2024-5652Desktop392to publicationYes
29 Jul 2024ZDI-24-1019CVE-2024-6222Desktop69to publicationYes
26 Jul 2024ZDI-24-966CVE-2024-5652Desktop65to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Docker's own alerts

What we watch

  • RSSDocker security announcements RSS
  • Advisory pageDocker security announcements page
  • BlueskyDocker on Bluesky

See sources and health for when each was last read.