Apple Containerization

• CVE-2026-113957 Medium 5.6 An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one <0.1%
• CVE-2026-65388 High 7.5 A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This 0.4%
• CVE-2026-20613 High 7.8 The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or malic 0.3%