GO-2025-3830: Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker

  GO-2026-4883: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker

  GO-2026-4887: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

  GO-2026-5617: Docker: Race condition in docker cp allows bind mount redirection to host path in github.com/docker/docker

  GO-2026-5668: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker

  GO-2026-5746: Docker: `PUT /containers/{id}/archive` executes container binary on the host in github.com/docker/docker