diff --git a/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh b/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh
index d795587..b5087ae 100644
--- a/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh
+++ b/linPEAS/builder/linpeas_parts/2_container/4_Docker_container_details.sh
@@ -6,7 +6,7 @@
 # License: GNU GPL
 # Version: 1.0
 # Mitre: T1613
-# Functions Used: checkDockerRootless, checkDockerVersionExploits, containerCheck, enumerateDockerSockets, inDockerGroup, print_2title, print_list
+# Functions Used: checkDockerRootless, checkDockerVersionExploits, containerCheck, enumerateDockerDesktopAPI, enumerateDockerSockets, inDockerGroup, print_2title, print_list
 # Global Variables: $containerType, $DOCKER_GROUP, $DOCKER_ROOTLESS, $dockerVersion, $inContainer, $VULN_CVE_2019_5736, $VULN_CVE_2019_13139, $VULN_CVE_2021_41091
 # Initial Functions: containerCheck
 # Generated Global Variables:
@@ -29,6 +29,8 @@ if echo "$containerType" | grep -qi "docker"; then
     if [ "$inContainer" ]; then
         checkDockerRootless
         print_list "Rootless Docker? ............... $DOCKER_ROOTLESS\n"$NC | sed -${E} "s,No,${SED_RED}," | sed -${E} "s,Yes,${SED_GREEN},"
+        print_list "Checking Docker Desktop internal Engine API (CVE-2025-9074):\n"$NC
+        enumerateDockerDesktopAPI
         echo ""
     fi
     if df -h | grep docker; then
diff --git a/linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh b/linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh
new file mode 100644
index 0000000..08023bc
--- /dev/null
+++ b/linPEAS/builder/linpeas_parts/functions/enumerateDockerDesktopAPI.sh
@@ -0,0 +1,36 @@
+# Title: Container - enumerateDockerDesktopAPI
+# ID: enumerateDockerDesktopAPI
+# Author: Carlos Polop
+# Last Update: 24-06-2026
+# Description: Check from inside a container if the Docker Desktop internal Engine API (CVE-2025-9074) is reachable over TCP on 192.168.65.7:2375 even when the docker socket is NOT mounted, which allows a full container escape.
+# License: GNU GPL
+# Version: 1.0
+# Functions Used:
+# Global Variables: $GREP_DOCKER_SOCK_INFOS, $GREP_DOCKER_SOCK_INFOS_IGNORE
+# Initial Functions:
+# Generated Global Variables: $SEARCHED_DOCKER_DESKTOP_API, $ddEndpoint, $ddInfoResponse
+# Fat linpeas: 0
+# Small linpeas: 1
+
+
+enumerateDockerDesktopAPI() {
+  if ! [ "$SEARCHED_DOCKER_DESKTOP_API" ]; then
+    SEARCHED_DOCKER_DESKTOP_API="1"
+    # Docker Desktop exposes its internal Engine API on the VM services host 192.168.65.7.
+    # CVE-2025-9074 (fixed in Docker Desktop 4.44.3) let a container reach this UNAUTHENTICATED
+    # Engine API on 192.168.65.7:2375 even when /var/run/docker.sock was NOT mounted, enabling a
+    # full container escape (e.g. creating a container that bind-mounts the host filesystem).
+    # Ref: https://nvd.nist.gov/vuln/detail/CVE-2025-9074
+    ddEndpoint="http://192.168.65.7:2375/info"
+    ddInfoResponse=""
+    if [ "$(command -v curl 2>/dev/null || echo -n '')" ]; then
+      ddInfoResponse="$(curl -s --max-time 3 "$ddEndpoint" 2>/dev/null)"
+    elif [ "$(command -v wget 2>/dev/null || echo -n '')" ]; then
+      ddInfoResponse="$(wget -q -T 3 -O - "$ddEndpoint" 2>/dev/null)"
+    fi
+    if echo "$ddInfoResponse" | grep -q "ServerVersion"; then
+      echo "Docker Desktop internal Engine API (CVE-2025-9074) reachable at 192.168.65.7:2375 - container escape possible!" | sed -${E} "s,reachable at 192.168.65.7:2375,${SED_RED_YELLOW},g"
+      echo "$ddInfoResponse" | tr ',' '\n' | grep -E "$GREP_DOCKER_SOCK_INFOS" | grep -v "$GREP_DOCKER_SOCK_INFOS_IGNORE" | tr -d '"'
+    fi
+  fi
+}
diff --git a/linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh b/linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh
index 75cfe74..6197414 100644
--- a/linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh
+++ b/linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh
@@ -1,7 +1,7 @@
 # Title: Function - kernel_cve_registry_checks
 # ID: kernel_cve_registry_checks
 # Author: Carlos Polop
-# Last Update: 25-02-2026
+# Last Update: 28-06-2026
 # Description: Evaluate declared kernel CVE rules using kernel version, arch, kernel config, sysctl and command prerequisites.
 # Description: Data source chunks KERNEL_CVE_DATA_1..22 are capped to 25 rows each.
 # License: GNU GPL
diff --git a/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh b/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh
index ca1343d..c833a98 100644
--- a/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh
+++ b/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh
@@ -1,7 +1,7 @@
 # Title: Variables - kernel_cve_registry_data
 # ID: kernel_cve_registry_data
 # Author: Carlos Polop
-# Last Update: 11-06-2026
+# Last Update: 28-06-2026
 # Description: Embedded kernel exploit matching datasets extracted from linux-exploit-suggester and linux-exploit-suggester-2 examples. Data is split across KERNEL_CVE_DATA_1..X with a maximum of 25 rows per env variable. This file also stores reference-only CVE tokens found in example repos when no explicit suggester matching rule exists.
 # License: GNU GPL
 # Version: 1.0
@@ -610,6 +610,7 @@ CVE-2017-16994	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token
 CVE-2020-27171	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from example repos; appears as related comment in exploit source
 CVE-2024-0193	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from example repos; appears as upstream source reference
 CVE-2026-43284	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from official Ubuntu/Red Hat Dirty Frag advisories; no stable matcher added
+CVE-2026-43494	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from official Ubuntu PinTheft advisory; no stable matcher added
 CVE-2026-43500	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from official Ubuntu/Red Hat Dirty Frag advisories; no stable matcher added
 CVE-2026-46243	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from official Red Hat CIFSwitch advisory; no stable matcher added
 CVE-2026-46300	catalog_reference_only	9999.9999.9999		0	Reference-only CVE token from official Ubuntu/Red Hat Fragnesia advisories; no stable matcher added
@@ -617,16 +618,16 @@ EOF_DATA_21
 )"
 
 KERNEL_CVE_DATA_22="$(cat <<'EOF_DATA_22'
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=3.16.52,ver<3.17,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue backported into 3.16 at 3.16.52
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.4.40,ver<4.5,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue backported into 4.4 at 4.4.40
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.8.16,ver<4.9,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue backported into 4.8 at 4.8.16
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.9.1,ver<4.10,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue backported into 4.9 at 4.9.1
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.10,ver<5.10.256,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 5.10.256
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=5.11,ver<5.15.207,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 5.15.207
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=5.16,ver<6.1.173,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 6.1.173
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.2,ver<6.6.139,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 6.6.139
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.7,ver<6.12.89,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 6.12.89
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.13,ver<6.18.31,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 6.18.31
-CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.19,ver<7.0.8,sysctl:kernel.yama.ptrace_scope!=2		1	Upstream issue introduced in 4.10; fixed in 7.0.8
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=3.16.52,ver<3.17,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue backported into 3.16 at 3.16.52; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.4.40,ver<4.5,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue backported into 4.4 at 4.4.40; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.8.16,ver<4.9,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue backported into 4.8 at 4.8.16; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.9.1,ver<4.10,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue backported into 4.9 at 4.9.1; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=4.10,ver<5.10.256,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 5.10.256; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=5.11,ver<5.15.207,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 5.15.207; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=5.16,ver<6.1.173,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 6.1.173; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.2,ver<6.6.139,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 6.6.139; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.7,ver<6.12.89,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 6.12.89; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.13,ver<6.18.31,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 6.18.31; mitigated by kernel.yama.ptrace_scope >= 2
+CVE-2026-46333	ptrace exit-race	pkg=linux-kernel,ver>=6.19,ver<7.0.8,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ]		1	Upstream issue introduced in 4.10; fixed in 7.0.8; mitigated by kernel.yama.ptrace_scope >= 2
 EOF_DATA_22
 )"