CVE-2026-113957

MediumCVSS 5.6/10Last modified Nov 4, 2026

Description

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-494

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Applecontainer< 1.6.0
Applecontainerization< 0.52.1

References

Timeline

Published
Oct 29, 2026
Last modified
Nov 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-113965.3The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versioCVE-2026-1139606.5This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.CVE-2026-1139617.5An authorization issue was addressed with improved validation. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS CVE-2026-1139635.5An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iCVE-2026-1139645.4A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18CVE-2026-1139655.4This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26CVE-2026-1139685.4A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18CVE-2026-1139697.5A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18CVE-2026-113975.5The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via tCVE-2026-1139708.8A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 andCVE-2026-1139713.5This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 CVE-2026-113985.3The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versio
CVE-2026-113957: Medium severity, CVSS 5.6 | Vulnix